diff --git a/appsec/src/extension/tags.c b/appsec/src/extension/tags.c
index 086c8e45c2..d5750394aa 100644
--- a/appsec/src/extension/tags.c
+++ b/appsec/src/extension/tags.c
@@ -20,6 +20,7 @@
 #include <SAPI.h>
 #include <Zend/zend.h>
 #include <zend_smart_str.h>
+#include <zend_string.h>
 #include <zend_types.h>
 
 #if PHP_VERSION_ID < 70200
@@ -48,8 +49,19 @@
 #define DD_METRIC_ENABLED "_dd.appsec.enabled"
 #define DD_APPSEC_EVENTS_PREFIX "appsec.events."
 #define DD_SIGNUP_EVENT DD_APPSEC_EVENTS_PREFIX "users.signup"
+#define DD_SIGNUP_EVENT_LOGIN DD_APPSEC_EVENTS_PREFIX "users.signup.usr.login"
+#define DD_LOGIN_SUCCESS_EVENT_LOGIN                                           \
+    DD_APPSEC_EVENTS_PREFIX "users.login.success.usr.login"
+#define DD_LOGIN_SUCCESS_EVENT_ID                                              \
+    DD_APPSEC_EVENTS_PREFIX "users.login.success.usr.id"
+#define DD_LOGIN_FAILURE_EVENT_LOGIN                                           \
+    DD_APPSEC_EVENTS_PREFIX "users.login.failure.usr.login"
+#define DD_LOGIN_FAILURE_EVENT_ID                                              \
+    DD_APPSEC_EVENTS_PREFIX "users.login.failure.usr.id"
 #define DD_LOGIN_SUCCESS_EVENT DD_APPSEC_EVENTS_PREFIX "users.login.success"
 #define DD_LOGIN_FAILURE_EVENT DD_APPSEC_EVENTS_PREFIX "users.login.failure"
+#define DD_APPSEC_USR_ID "_dd.appsec.usr.id"
+#define DD_APPSEC_USR_LOGIN "_dd.appsec.usr.login"
 #define DD_EVENTS_USER_SIGNUP_AUTO_MODE                                        \
     "_dd.appsec.events.users.signup.auto.mode"
 #define DD_EVENTS_USER_LOGIN_SUCCESS_AUTO_MODE                                 \
@@ -62,6 +74,12 @@
 #define DD_EVENTS_USER_LOGIN_FAILURE_SDK                                       \
     "_dd.appsec.events.users.login.failure.sdk"
 #define DD_EVENTS_RASP_DURATION_EXT "_dd.appsec.rasp.duration_ext"
+#define DD_SERVER_BUSINESS_LOGIC_USERS_SIGNUP                                  \
+    "server.business_logic.users.signup"
+#define DD_SERVER_BUSINESS_LOGIC_USERS_LOGIN_SUCCESS                           \
+    "server.business_logic.users.login.success"
+#define DD_SERVER_BUSINESS_LOGIC_USERS_LOGIN_FAILURE                           \
+    "server.business_logic.users.login.failure"
 
 static zend_string *_dd_tag_data_zstr;
 static zend_string *_dd_tag_event_zstr;
@@ -82,10 +100,19 @@ static zend_string *_dd_tag_rh_content_language; // response
 static zend_string *_dd_tag_user_id;
 static zend_string *_dd_metric_enabled;
 static zend_string *_dd_rasp_duration_ext;
+static zend_string *_dd_business_logic_users_signup;
+static zend_string *_dd_business_logic_users_login_success;
+static zend_string *_dd_business_logic_users_login_failure;
 static zend_string *_dd_signup_event;
+static zend_string *_dd_signup_event_login;
+static zend_string *_dd_login_success_event_login;
+static zend_string *_dd_login_success_event_id;
+static zend_string *_dd_login_failure_event_login;
+static zend_string *_dd_login_failure_event_id;
 static zend_string *_dd_login_success_event;
 static zend_string *_dd_login_failure_event;
-static zend_string *_dd_login_failure_event;
+static zend_string *_dd_appsec_user_id;
+static zend_string *_dd_appsec_user_login;
 static zend_string *_dd_signup_event_auto_mode;
 static zend_string *_dd_login_success_event_auto_mode;
 static zend_string *_dd_login_failure_event_auto_mode;
@@ -99,6 +126,7 @@ static zend_string *_key_http_user_agent_zstr;
 static zend_string *_key_https_zstr;
 static zend_string *_key_remote_addr_zstr;
 static zend_string *_1_zstr;
+static zend_string *_null_zstr;
 static zend_string *_true_zstr;
 static zend_string *_false_zstr;
 static zend_string *_track_zstr;
@@ -134,6 +162,7 @@ void dd_tags_startup()
     _dd_tag_blocked_zstr =
         zend_string_init_interned(LSTRARG(DD_TAG_BLOCKED), 1 /* permanent */);
     _1_zstr = zend_string_init_interned(LSTRARG("1"), 1 /* permanent */);
+    _null_zstr = zend_string_init_interned(LSTRARG("null"), 1 /* permanent */);
     _true_zstr = zend_string_init_interned(LSTRARG("true"), 1 /* permanent */);
     _false_zstr =
         zend_string_init_interned(LSTRARG("false"), 1 /* permanent */);
@@ -188,10 +217,24 @@ void dd_tags_startup()
     _track_zstr =
         zend_string_init_interned(LSTRARG("track"), 1 /* permanent */);
     _dd_signup_event = zend_string_init_interned(LSTRARG(DD_SIGNUP_EVENT), 1);
+    _dd_signup_event_login =
+        zend_string_init_interned(LSTRARG(DD_SIGNUP_EVENT_LOGIN), 1);
+    _dd_login_success_event_login =
+        zend_string_init_interned(LSTRARG(DD_LOGIN_SUCCESS_EVENT_LOGIN), 1);
+    _dd_login_success_event_id =
+        zend_string_init_interned(LSTRARG(DD_LOGIN_SUCCESS_EVENT_ID), 1);
+    _dd_login_failure_event_login =
+        zend_string_init_interned(LSTRARG(DD_LOGIN_FAILURE_EVENT_LOGIN), 1);
+    _dd_login_failure_event_id =
+        zend_string_init_interned(LSTRARG(DD_LOGIN_FAILURE_EVENT_ID), 1);
     _dd_login_success_event =
         zend_string_init_interned(LSTRARG(DD_LOGIN_SUCCESS_EVENT), 1);
     _dd_login_failure_event =
         zend_string_init_interned(LSTRARG(DD_LOGIN_FAILURE_EVENT), 1);
+    _dd_appsec_user_id =
+        zend_string_init_interned(LSTRARG(DD_APPSEC_USR_ID), 1);
+    _dd_appsec_user_login =
+        zend_string_init_interned(LSTRARG(DD_APPSEC_USR_LOGIN), 1);
     _dd_signup_event_auto_mode =
         zend_string_init_interned(LSTRARG(DD_EVENTS_USER_SIGNUP_AUTO_MODE), 1);
     _dd_login_success_event_auto_mode = zend_string_init_interned(
@@ -206,6 +249,12 @@ void dd_tags_startup()
         zend_string_init_interned(LSTRARG(DD_EVENTS_USER_LOGIN_FAILURE_SDK), 1);
     _usr_exists_zstr =
         zend_string_init_interned(LSTRARG("usr.exists"), 1 /* permanent */);
+    _dd_business_logic_users_signup = zend_string_init_interned(
+        LSTRARG(DD_SERVER_BUSINESS_LOGIC_USERS_SIGNUP), 1);
+    _dd_business_logic_users_login_success = zend_string_init_interned(
+        LSTRARG(DD_SERVER_BUSINESS_LOGIC_USERS_LOGIN_SUCCESS), 1);
+    _dd_business_logic_users_login_failure = zend_string_init_interned(
+        LSTRARG(DD_SERVER_BUSINESS_LOGIC_USERS_LOGIN_FAILURE), 1);
 
     _server_zstr = zend_string_init_interned(LSTRARG("_SERVER"), 1);
 
@@ -217,14 +266,17 @@ void dd_tags_startup()
         _register_test_functions();
     }
 }
+
 static void _init_relevant_headers()
 {
     zend_hash_init(&_relevant_headers, 32, NULL, NULL, 1);
     zend_hash_init(&_relevant_basic_headers, 32, NULL, NULL, 1);
     zval nullzv;
     ZVAL_NULL(&nullzv);
+
 #define ADD_RELEVANT_HEADER(str)                                               \
     zend_hash_str_add_new(&_relevant_headers, str "", sizeof(str) - 1, &nullzv);
+
 #define ADD_RELEVANT_BASIC_HEADER(str)                                         \
     zend_hash_str_add_new(                                                     \
         &_relevant_basic_headers, str "", sizeof(str) - 1, &nullzv);           \
@@ -262,6 +314,7 @@ static void _init_relevant_headers()
     ADD_RELEVANT_HEADER("accept-language");
 
 #undef ADD_RELEVANT_HEADER
+#undef ADD_RELEVANT_BASIC_HEADER
 
     zend_hash_copy(
         &_relevant_headers, get_global_DD_APPSEC_EXTRA_HEADERS(), NULL);
@@ -550,6 +603,7 @@ static void _add_new_zstr_to_meta(zend_array *meta_ht, zend_string *key,
         zend_string_release(val);
     }
 }
+
 static void _dd_http_method(zend_array *meta_ht)
 {
     if (zend_hash_exists(meta_ht, _dd_tag_http_method_zstr)) {
@@ -909,7 +963,7 @@ static zval *nullable _root_span_get_meta()
     return meta;
 }
 
-static PHP_FUNCTION(datadog_appsec_track_user_signup_event)
+static PHP_FUNCTION(datadog_appsec_track_user_signup_event_automated)
 {
     UNUSED(return_value);
     if (!DDAPPSEC_G(active)) {
@@ -918,82 +972,233 @@ static PHP_FUNCTION(datadog_appsec_track_user_signup_event)
         return;
     }
 
-    zend_string *user_id = NULL;
+    zend_string *user_login;
+    zend_string *user_id;
+    zend_string *anon_user_login = NULL;
+    zend_string *anon_user_id = NULL;
     HashTable *metadata = NULL;
-    zend_bool automated = false; // Don't document. Only internal usage
-    zend_bool copy_user_id = true;
-    if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|hb", &user_id, &metadata,
-            &automated) == FAILURE) {
+    if (zend_parse_parameters(ZEND_NUM_ARGS(), "SS|h", &user_login, &user_id,
+            &metadata) == FAILURE) {
         mlog(dd_log_warning, "Unexpected parameter combination, expected "
-                             "(user_id, metadata)");
+                             "(user_login, user_id, metadata)");
         return;
     }
 
-    if (automated) {
-        user_collection_mode mode = dd_get_user_collection_mode();
-        if (mode == user_mode_disabled ||
-            !get_DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED()) {
-            return;
-        }
+    if (ZSTR_LEN(user_login) == 0) {
+        mlog(dd_log_warning, "Unexpected empty user login");
+        return;
+    }
 
-        if (mode == user_mode_anon) {
-            // Anonymize the user ID and ensure it isn't copied twice
-            user_id = dd_user_id_anonymize(user_id);
-            if (user_id == NULL) {
-                mlog(dd_log_debug, "Failed to anonymize user ID");
-                return;
-            }
+    zval *nullable meta = _root_span_get_meta();
+    if (!meta) {
+        return;
+    }
+
+    _user_event_triggered = true;
+    zend_array *meta_ht = Z_ARRVAL_P(meta);
+
+    user_collection_mode mode = dd_get_user_collection_mode();
+    if (mode == user_mode_disabled ||
+        !get_DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED()) {
+        return;
+    }
 
-            copy_user_id = false;
+    if (mode == user_mode_anon) {
+        anon_user_id = dd_user_info_anonymize(user_id);
+        if (!anon_user_id) {
+            mlog(dd_log_debug, "Failed to anonymize user ID");
+            return;
         }
-    } else {
-        if (user_id == NULL || ZSTR_LEN(user_id) == 0) {
-            mlog(dd_log_warning, "Unexpected empty user id");
+
+        anon_user_login = dd_user_info_anonymize(user_login);
+        if (!anon_user_login) {
+            mlog(dd_log_debug, "Failed to anonymize user login");
+            zend_string_release(anon_user_id);
             return;
         }
     }
 
+    if (ZSTR_LEN(user_id) > 0) {
+        // appsec.events.users.signup.usr.id = <user_id>
+        _add_custom_event_keyval(meta_ht, _dd_signup_event, _dd_tag_user_id,
+            anon_user_id ? anon_user_id : user_id, true, false);
+
+        // _dd.appsec.usr.id = <user_id>
+        _add_new_zstr_to_meta(meta_ht, _dd_appsec_user_id,
+            anon_user_id ? anon_user_id : user_id, !anon_user_id, true);
+    } else if (anon_user_id) {
+        zend_string_release(anon_user_id);
+    }
+
+    // _dd.appsec.events.users.signup.auto.mode =
+    // <DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING>
+    _add_new_zstr_to_meta(meta_ht, _dd_signup_event_auto_mode,
+        dd_get_user_collection_mode_zstr(), true, false);
+
+    // _dd.appsec.events.users.signup.usr.login = <user_login>
+    _add_new_zstr_to_meta(meta_ht, _dd_signup_event_login,
+        anon_user_login ? anon_user_login : user_login, true, false);
+
+    // _dd.appsec.usr.login = <user_login>
+    _add_new_zstr_to_meta(meta_ht, _dd_appsec_user_login,
+        anon_user_login ? anon_user_login : user_login, !anon_user_login, true);
+
+    // appsec.events.users.signup.success.track = true
+    _add_custom_event_keyval(
+        meta_ht, _dd_signup_event, _track_zstr, _true_zstr, true, false);
+
+    // server.business_logic.users.signup = null
+    _add_new_zstr_to_meta(
+        meta_ht, _dd_business_logic_users_signup, _null_zstr, true, true);
+
+    dd_tags_set_sampling_priority();
+}
+
+static PHP_FUNCTION(datadog_appsec_track_user_signup_event)
+{
+    UNUSED(return_value);
+    if (!DDAPPSEC_G(active)) {
+        mlog(dd_log_debug, "Trying to access to track_user_signup_event "
+                           "function while appsec is disabled");
+        return;
+    }
+
+    zend_string *user_id = NULL;
+    HashTable *metadata = NULL;
+    if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|h", &user_id, &metadata) ==
+        FAILURE) {
+        mlog(dd_log_warning, "Unexpected parameter combination, expected "
+                             "(user_id, metadata)");
+        return;
+    }
+
+    if (ZSTR_LEN(user_id) == 0) {
+        mlog(dd_log_warning, "Unexpected empty user id");
+        return;
+    }
+
     zval *nullable meta = _root_span_get_meta();
     if (!meta) {
-        if (!copy_user_id) {
-            zend_string_release(user_id);
-        }
         return;
     }
 
     _user_event_triggered = true;
+    zend_array *meta_ht = Z_ARRVAL_P(meta);
+
+    // appsec.events.users.signup.usr.id = <user_id>
+    _add_custom_event_keyval(
+        meta_ht, _dd_signup_event, _dd_tag_user_id, user_id, true, true);
+
+    // _dd.appsec.events.users.signup.usr.login = <user_login>
+    _add_new_zstr_to_meta(meta_ht, _dd_signup_event_login, user_id, true, true);
+
+    // _dd.appsec.events.users.signup.sdk = true
+    _add_new_zstr_to_meta(
+        meta_ht, _dd_signup_event_sdk, _true_zstr, true, true);
+
+    // appsec.events.users.signup.<key> = <value>
+    _add_custom_event_metadata(meta_ht, _dd_signup_event, metadata, true);
+
+    // appsec.events.users.signup.success.track = true
+    _add_custom_event_keyval(
+        meta_ht, _dd_signup_event, _track_zstr, _true_zstr, true, true);
+
+    // server.business_logic.users.signup = null
+    _add_new_zstr_to_meta(
+        meta_ht, _dd_business_logic_users_signup, _null_zstr, true, true);
+
+    dd_tags_set_sampling_priority();
+}
+
+static PHP_FUNCTION(datadog_appsec_track_user_login_success_event_automated)
+{
+    UNUSED(return_value);
+    if (!DDAPPSEC_G(active)) {
+        mlog(dd_log_debug, "Trying to access to track_user_login_success_event "
+                           "function while appsec is disabled");
+        return;
+    }
 
+    zend_string *user_login;
+    zend_string *user_id;
+    zend_string *anon_user_login = NULL;
+    zend_string *anon_user_id = NULL;
+    HashTable *metadata = NULL;
+    if (zend_parse_parameters(ZEND_NUM_ARGS(), "SS|h", &user_login, &user_id,
+            &metadata) == FAILURE) {
+        mlog(dd_log_warning, "Unexpected parameter combination, expected "
+                             "(user_login, user_id, metadata)");
+        return;
+    }
+
+    if (ZSTR_LEN(user_login) == 0) {
+        mlog(dd_log_warning, "Unexpected empty user login");
+        return;
+    }
+
+    zval *nullable meta = _root_span_get_meta();
+    if (!meta) {
+        return;
+    }
+
+    _user_event_triggered = true;
     zend_array *meta_ht = Z_ARRVAL_P(meta);
-    bool override = !automated;
 
-    if (user_id && ZSTR_LEN(user_id) > 0) {
-        // usr.id = <user_id>
-        _add_new_zstr_to_meta(
-            meta_ht, _dd_tag_user_id, user_id, copy_user_id, override);
+    user_collection_mode mode = dd_get_user_collection_mode();
+    if (mode == user_mode_disabled ||
+        !get_DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED()) {
+        return;
     }
 
-    if (automated) {
-        // In automated mode, metadata must no longer be sent
+    if (mode == user_mode_anon) {
+        anon_user_id = dd_user_info_anonymize(user_id);
+        if (!anon_user_id) {
+            mlog(dd_log_debug, "Failed to anonymize user ID");
+            return;
+        }
 
-        // _dd.appsec.events.users.signup.auto.mode =
-        // <DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING>
-        if (dd_get_user_collection_mode() != user_mode_disabled) {
-            _add_new_zstr_to_meta(meta_ht, _dd_signup_event_auto_mode,
-                dd_get_user_collection_mode_zstr(), true, override);
+        anon_user_login = dd_user_info_anonymize(user_login);
+        if (!anon_user_login) {
+            mlog(dd_log_debug, "Failed to anonymize user login");
+            zend_string_release(anon_user_id);
+            return;
         }
-    } else {
-        // _dd.appsec.events.users.signup.sdk = true
-        _add_new_zstr_to_meta(
-            meta_ht, _dd_signup_event_sdk, _true_zstr, true, override);
+    }
+
+    if (ZSTR_LEN(user_id) > 0) {
+        dd_find_and_apply_verdict_for_user(user_id);
+
+        // usr.id = <user_id>
+        _add_new_zstr_to_meta(meta_ht, _dd_tag_user_id,
+            anon_user_id ? anon_user_id : user_id, true, false);
 
-        // appsec.events.users.signup.<key> = <value>
-        _add_custom_event_metadata(
-            meta_ht, _dd_signup_event, metadata, override);
+        // _dd.appsec.usr.id = <user_id>
+        _add_new_zstr_to_meta(meta_ht, _dd_appsec_user_id,
+            anon_user_id ? anon_user_id : user_id, !anon_user_id, true);
+    } else if (anon_user_id) {
+        zend_string_release(anon_user_id);
     }
 
+    // _dd.appsec.events.users.login.success.auto.mode =
+    // <DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING>
+    _add_new_zstr_to_meta(meta_ht, _dd_login_success_event_auto_mode,
+        dd_get_user_collection_mode_zstr(), true, false);
+
+    // _dd.appsec.events.users.login.success.usr.login = <user_login>
+    _add_new_zstr_to_meta(meta_ht, _dd_login_success_event_login,
+        anon_user_login ? anon_user_login : user_login, true, false);
+
+    // _dd.appsec.usr.login = <user_login>
+    _add_new_zstr_to_meta(meta_ht, _dd_appsec_user_login,
+        anon_user_login ? anon_user_login : user_login, !anon_user_login, true);
+
     // appsec.events.users.login.success.track = true
     _add_custom_event_keyval(
-        meta_ht, _dd_signup_event, _track_zstr, _true_zstr, true, override);
+        meta_ht, _dd_login_success_event, _track_zstr, _true_zstr, true, false);
+
+    // server.business_logic.users.login.success = null
+    _add_new_zstr_to_meta(meta_ht, _dd_business_logic_users_login_success,
+        _null_zstr, true, true);
 
     dd_tags_set_sampling_priority();
 }
@@ -1007,86 +1212,57 @@ static PHP_FUNCTION(datadog_appsec_track_user_login_success_event)
         return;
     }
 
-    zend_string *user_id = NULL;
+    zend_string *user_id;
     HashTable *metadata = NULL;
-    zend_bool automated = false; // Don't document. Only internal usage
-    zend_bool copy_user_id = true;
-    if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|hb", &user_id, &metadata,
-            &automated) == FAILURE) {
+    if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|h", &user_id, &metadata) ==
+        FAILURE) {
         mlog(dd_log_warning, "Unexpected parameter combination, expected "
                              "(user_id, metadata)");
         return;
     }
-    if (automated) {
-        user_collection_mode mode = dd_get_user_collection_mode();
-        if (mode == user_mode_disabled ||
-            !get_DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED()) {
-            return;
-        }
-
-        if (mode == user_mode_anon) {
-            user_id = dd_user_id_anonymize(user_id);
-            if (user_id == NULL) {
-                mlog(dd_log_debug, "Failed to anonymize user ID");
-                return;
-            }
 
-            copy_user_id = false;
-        }
-    } else {
-        if (user_id == NULL || ZSTR_LEN(user_id) == 0) {
-            mlog(dd_log_warning, "Unexpected empty user id");
-            return;
-        }
+    if (ZSTR_LEN(user_id) == 0) {
+        mlog(dd_log_warning, "Unexpected empty user id");
+        return;
     }
 
     zval *nullable meta = _root_span_get_meta();
     if (!meta) {
-        if (!copy_user_id) {
-            zend_string_release(user_id);
-        }
         return;
     }
 
     _user_event_triggered = true;
-
     zend_array *meta_ht = Z_ARRVAL_P(meta);
-    bool override = !automated;
 
-    if (user_id && ZSTR_LEN(user_id) > 0) {
-        dd_find_and_apply_verdict_for_user(user_id);
-        // usr.id = <user_id>
-        _add_new_zstr_to_meta(
-            meta_ht, _dd_tag_user_id, user_id, copy_user_id, override);
-    }
+    dd_find_and_apply_verdict_for_user(user_id);
 
-    if (automated) {
-        // In automated mode, metadata must no longer be sent
+    // usr.id = <user_id>
+    _add_new_zstr_to_meta(meta_ht, _dd_tag_user_id, user_id, true, true);
 
-        // _dd.appsec.events.users.login.success.auto.mode =
-        // <DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING>
-        if (dd_get_user_collection_mode() != user_mode_disabled) {
-            _add_new_zstr_to_meta(meta_ht, _dd_login_success_event_auto_mode,
-                dd_get_user_collection_mode_zstr(), true, override);
-        }
-    } else {
-        // _dd.appsec.events.users.login.success.sdk = true
-        _add_new_zstr_to_meta(
-            meta_ht, _dd_login_success_event_sdk, _true_zstr, true, override);
+    // _dd.appsec.events.users.login.success.usr.login = <user_login>
+    _add_new_zstr_to_meta(
+        meta_ht, _dd_login_success_event_login, user_id, true, true);
 
-        // appsec.events.users.login.success.<key> = <value>
-        _add_custom_event_metadata(
-            meta_ht, _dd_login_success_event, metadata, override);
-    }
+    // _dd.appsec.events.users.login.success.sdk = true
+    _add_new_zstr_to_meta(
+        meta_ht, _dd_login_success_event_sdk, _true_zstr, true, true);
+
+    // appsec.events.users.login.success.<key> = <value>
+    _add_custom_event_metadata(
+        meta_ht, _dd_login_success_event, metadata, true);
 
     // appsec.events.users.login.success.track = true
-    _add_custom_event_keyval(meta_ht, _dd_login_success_event, _track_zstr,
-        _true_zstr, true, override);
+    _add_custom_event_keyval(
+        meta_ht, _dd_login_success_event, _track_zstr, _true_zstr, true, true);
+
+    // server.business_logic.users.login.success = null
+    _add_new_zstr_to_meta(meta_ht, _dd_business_logic_users_login_success,
+        _null_zstr, true, true);
 
     dd_tags_set_sampling_priority();
 }
 
-static PHP_FUNCTION(datadog_appsec_track_user_login_failure_event)
+static PHP_FUNCTION(datadog_appsec_track_user_login_failure_event_automated)
 {
     UNUSED(return_value);
     if (!DDAPPSEC_G(active)) {
@@ -1095,85 +1271,154 @@ static PHP_FUNCTION(datadog_appsec_track_user_login_failure_event)
         return;
     }
 
-    zend_string *user_id = NULL;
-    zend_bool exists = false;
+    zend_string *user_login;
+    zend_string *user_id;
+    zend_string *anon_user_login = NULL;
+    zend_string *anon_user_id = NULL;
+    zend_bool exists;
     HashTable *metadata = NULL;
-    zend_bool automated = false; // Don't document. Only internal usage
-    if (zend_parse_parameters(ZEND_NUM_ARGS(), "Sb|hb", &user_id, &exists,
-            &metadata, &automated) == FAILURE) {
+    if (zend_parse_parameters(ZEND_NUM_ARGS(), "SSb|h", &user_login, &user_id,
+            &exists, &metadata) == FAILURE) {
         mlog(dd_log_warning, "Unexpected parameter combination, expected "
-                             "(user_id, exists, metadata)");
+                             "(user_login, user_id, exists, metadata)");
+        return;
+    }
+
+    zval *nullable meta = _root_span_get_meta();
+    if (!meta) {
         return;
     }
 
-    zend_bool copy_user_id = true;
-    if (automated) {
-        user_collection_mode mode = dd_get_user_collection_mode();
-        if (mode == user_mode_disabled ||
-            !get_DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED()) {
+    _user_event_triggered = true;
+    zend_array *meta_ht = Z_ARRVAL_P(meta);
+
+    user_collection_mode mode = dd_get_user_collection_mode();
+    if (mode == user_mode_disabled ||
+        !get_DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED()) {
+        return;
+    }
+
+    if (mode == user_mode_anon) {
+        anon_user_id = dd_user_info_anonymize(user_id);
+        if (!anon_user_id) {
+            mlog(dd_log_debug, "Failed to anonymize user ID");
             return;
         }
 
-        if (mode == user_mode_anon) {
-            user_id = dd_user_id_anonymize(user_id);
-            if (user_id == NULL) {
-                mlog(dd_log_debug, "Failed to anonymize user ID");
-                return;
-            }
-
-            copy_user_id = false;
+        anon_user_login = dd_user_info_anonymize(user_login);
+        if (!anon_user_login) {
+            mlog(dd_log_debug, "Failed to anonymize user login");
+            zend_string_release(anon_user_id);
+            return;
+        }
 
-            if (metadata != NULL && zend_array_count(metadata) > 0) {
-                metadata = NULL;
-            }
+        if (metadata && zend_array_count(metadata) > 0) {
+            metadata = NULL;
         }
     }
 
+    if (ZSTR_LEN(user_id) > 0) {
+        // appsec.events.users.login.failure.usr.id = <user_id>
+        _add_custom_event_keyval(meta_ht, _dd_login_failure_event,
+            _dd_tag_user_id, anon_user_id ? anon_user_id : user_id, true,
+            false);
+
+        // _dd.appsec.usr.id = <user_id>
+        _add_new_zstr_to_meta(meta_ht, _dd_appsec_user_id,
+            anon_user_id ? anon_user_id : user_id, !anon_user_id, true);
+    } else if (anon_user_id) {
+        zend_string_release(anon_user_id);
+    }
+
+    // _dd.appsec.events.users.login.failure.auto.mode =
+    // <DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING>
+    _add_new_zstr_to_meta(meta_ht, _dd_login_failure_event_auto_mode,
+        dd_get_user_collection_mode_zstr(), true, false);
+
+    if (ZSTR_LEN(user_login) > 0) {
+        // _dd.appsec.events.users.login.failure.usr.login = <user_login>
+        _add_new_zstr_to_meta(meta_ht, _dd_login_failure_event_login,
+            anon_user_login ? anon_user_login : user_login, true, false);
+
+        // _dd.appsec.usr.login = <user_login>
+        _add_new_zstr_to_meta(meta_ht, _dd_appsec_user_login,
+            anon_user_login ? anon_user_login : user_login, !anon_user_login,
+            true);
+    } else if (anon_user_login) {
+        zend_string_release(anon_user_login);
+    }
+
+    // appsec.events.users.login.failure.track = true
+    _add_custom_event_keyval(
+        meta_ht, _dd_login_failure_event, _track_zstr, _true_zstr, true, false);
+
+    // appsec.events.users.login.failure.usr.exists = <exists>
+    _add_custom_event_keyval(meta_ht, _dd_login_failure_event, _usr_exists_zstr,
+        exists ? _true_zstr : _false_zstr, true, false);
+
+    // server.business_logic.users.login.failure = null
+    _add_new_zstr_to_meta(meta_ht, _dd_business_logic_users_login_failure,
+        _null_zstr, true, true);
+
+    dd_tags_set_sampling_priority();
+}
+
+static PHP_FUNCTION(datadog_appsec_track_user_login_failure_event)
+{
+    UNUSED(return_value);
+    if (!DDAPPSEC_G(active)) {
+        mlog(dd_log_debug, "Trying to access to track_user_login_failure_event "
+                           "function while appsec is disabled");
+        return;
+    }
+
+    zend_string *user_id;
+    zend_bool exists;
+    HashTable *metadata = NULL;
+    if (zend_parse_parameters(
+            ZEND_NUM_ARGS(), "Sb|h", &user_id, &exists, &metadata) == FAILURE) {
+        mlog(dd_log_warning, "Unexpected parameter combination, expected "
+                             "(user_id, exists, metadata)");
+        return;
+    }
+
     zval *nullable meta = _root_span_get_meta();
     if (!meta) {
-        if (!copy_user_id) {
-            zend_string_release(user_id);
-        }
         return;
     }
 
     _user_event_triggered = true;
-
     zend_array *meta_ht = Z_ARRVAL_P(meta);
-    bool override = !automated;
 
-    if (user_id != NULL && ZSTR_LEN(user_id) > 0) {
+    if (ZSTR_LEN(user_id) > 0) {
         // appsec.events.users.login.failure.usr.id = <user_id>
         _add_custom_event_keyval(meta_ht, _dd_login_failure_event,
-            _dd_tag_user_id, user_id, copy_user_id, override);
+            _dd_tag_user_id, user_id, true, true);
+
+        // _dd.appsec.events.users.login.failure.usr.login = <user_login>
+        _add_new_zstr_to_meta(
+            meta_ht, _dd_login_failure_event_login, user_id, true, true);
     }
 
     // appsec.events.users.login.failure.track = true
-    _add_custom_event_keyval(meta_ht, _dd_login_failure_event, _track_zstr,
-        _true_zstr, true, override);
-
-    if (automated) {
-        // In automated mode, metadata must no longer be sent
+    _add_custom_event_keyval(
+        meta_ht, _dd_login_failure_event, _track_zstr, _true_zstr, true, true);
 
-        // _dd.appsec.events.users.login.failure.auto.mode =
-        // <DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING>
-        if (dd_get_user_collection_mode() != user_mode_disabled) {
-            _add_new_zstr_to_meta(meta_ht, _dd_login_failure_event_auto_mode,
-                dd_get_user_collection_mode_zstr(), true, override);
-        }
-    } else {
-        // _dd.appsec.events.users.login.success.sdk = true
-        _add_new_zstr_to_meta(
-            meta_ht, _dd_login_failure_event_sdk, _true_zstr, true, override);
+    // _dd.appsec.events.users.login.failure.sdk = true
+    _add_new_zstr_to_meta(
+        meta_ht, _dd_login_failure_event_sdk, _true_zstr, true, true);
 
-        // appsec.events.users.login.failure.<key> = <value>
-        _add_custom_event_metadata(
-            meta_ht, _dd_login_failure_event, metadata, override);
-    }
+    // appsec.events.users.login.failure.<key> = <value>
+    _add_custom_event_metadata(
+        meta_ht, _dd_login_failure_event, metadata, true);
 
     // appsec.events.users.login.failure.usr.exists = <exists>
     _add_custom_event_keyval(meta_ht, _dd_login_failure_event, _usr_exists_zstr,
-        exists ? _true_zstr : _false_zstr, true, override);
+        exists ? _true_zstr : _false_zstr, true, true);
+
+    // server.business_logic.users.login.failure = null
+    _add_new_zstr_to_meta(meta_ht, _dd_business_logic_users_login_failure,
+        _null_zstr, true, true);
 
     dd_tags_set_sampling_priority();
 }
@@ -1283,23 +1528,39 @@ ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(add_ancillary_tags, 0, 1, IS_VOID, 0)
     ZEND_ARG_TYPE_INFO(2, "_server", IS_ARRAY, 0)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(track_user_login_success_event_arginfo, 0, 0, IS_VOID, 3)
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(track_user_login_success_event_automated_arginfo, 0, 0, IS_VOID, 3)
+ZEND_ARG_INFO(0, user_login)
 ZEND_ARG_INFO(0, user_id)
 ZEND_ARG_INFO(0, metadata)
-ZEND_ARG_INFO(0, automated)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(datadog_appsec_track_user_signup_event_arginfo, 0, 0, IS_VOID, 3)
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(track_user_login_success_event_arginfo, 0, 0, IS_VOID, 2)
 ZEND_ARG_INFO(0, user_id)
 ZEND_ARG_INFO(0, metadata)
-ZEND_ARG_INFO(0, automated)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(track_user_login_failure_event_arginfo, 0, 0, IS_VOID, 4)
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(track_user_signup_event_automated_arginfo, 0, 0, IS_VOID, 3)
+ZEND_ARG_INFO(0, user_login)
+ZEND_ARG_INFO(0, user_id)
+ZEND_ARG_INFO(0, metadata)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(track_user_signup_event_arginfo, 0, 0, IS_VOID, 2)
+ZEND_ARG_INFO(0, user_id)
+ZEND_ARG_INFO(0, metadata)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(track_user_login_failure_event_automated_arginfo, 0, 0, IS_VOID, 4)
+ZEND_ARG_INFO(0, user_login)
+ZEND_ARG_INFO(0, user_id)
+ZEND_ARG_INFO(0, exists)
+ZEND_ARG_INFO(0, metadata)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(track_user_login_failure_event_arginfo, 0, 0, IS_VOID, 3)
 ZEND_ARG_INFO(0, user_id)
 ZEND_ARG_INFO(0, exists)
 ZEND_ARG_INFO(0, metadata)
-ZEND_ARG_INFO(0, automated)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(track_custom_event_arginfo, 0, 0, IS_VOID, 2)
@@ -1308,8 +1569,11 @@ ZEND_ARG_INFO(0, metadata)
 ZEND_END_ARG_INFO()
 
 static const zend_function_entry functions[] = {
-    ZEND_RAW_FENTRY(DD_APPSEC_NS "track_user_signup_event", PHP_FN(datadog_appsec_track_user_signup_event), datadog_appsec_track_user_signup_event_arginfo, 0, NULL, NULL)
+    ZEND_RAW_FENTRY(DD_APPSEC_NS "track_user_signup_event_automated", PHP_FN(datadog_appsec_track_user_signup_event_automated), track_user_signup_event_automated_arginfo, 0, NULL, NULL)
+    ZEND_RAW_FENTRY(DD_APPSEC_NS "track_user_signup_event", PHP_FN(datadog_appsec_track_user_signup_event), track_user_signup_event_arginfo, 0, NULL, NULL)
+    ZEND_RAW_FENTRY(DD_APPSEC_NS "track_user_login_success_event_automated", PHP_FN(datadog_appsec_track_user_login_success_event_automated), track_user_login_success_event_automated_arginfo, 0, NULL, NULL)
     ZEND_RAW_FENTRY(DD_APPSEC_NS "track_user_login_success_event", PHP_FN(datadog_appsec_track_user_login_success_event), track_user_login_success_event_arginfo, 0, NULL, NULL)
+    ZEND_RAW_FENTRY(DD_APPSEC_NS "track_user_login_failure_event_automated", PHP_FN(datadog_appsec_track_user_login_failure_event_automated), track_user_login_failure_event_automated_arginfo, 0, NULL, NULL)
     ZEND_RAW_FENTRY(DD_APPSEC_NS "track_user_login_failure_event", PHP_FN(datadog_appsec_track_user_login_failure_event), track_user_login_failure_event_arginfo, 0, NULL, NULL)
     ZEND_RAW_FENTRY(DD_APPSEC_NS "track_custom_event", PHP_FN(datadog_appsec_track_custom_event), track_custom_event_arginfo, 0, NULL, NULL)
     PHP_FE_END
diff --git a/appsec/src/extension/user_tracking.c b/appsec/src/extension/user_tracking.c
index 8bf6bf749d..f930293373 100644
--- a/appsec/src/extension/user_tracking.c
+++ b/appsec/src/extension/user_tracking.c
@@ -181,7 +181,7 @@ bool dd_parse_user_collection_mode(
     return true;
 }
 
-zend_string *nullable dd_user_id_anonymize(zend_string *nonnull user_id)
+zend_string *nullable dd_user_info_anonymize(zend_string *nonnull user_info)
 {
     zend_string *digest;
     const php_hash_ops *ops;
@@ -215,7 +215,7 @@ zend_string *nullable dd_user_id_anonymize(zend_string *nonnull user_id)
 #endif
 
     ops->hash_update(
-        context, (unsigned char *)ZSTR_VAL(user_id), ZSTR_LEN(user_id));
+        context, (unsigned char *)ZSTR_VAL(user_info), ZSTR_LEN(user_info));
 
     digest = zend_string_alloc(ops->digest_size, 0);
     ops->hash_final((unsigned char *)ZSTR_VAL(digest), context);
diff --git a/appsec/src/extension/user_tracking.h b/appsec/src/extension/user_tracking.h
index 2137b8c0c4..fa722267f2 100644
--- a/appsec/src/extension/user_tracking.h
+++ b/appsec/src/extension/user_tracking.h
@@ -23,7 +23,7 @@ void dd_find_and_apply_verdict_for_user(zend_string *nonnull user_id);
 bool dd_parse_user_collection_mode(
     zai_str value, zval *nonnull decoded_value, bool persistent);
 
-zend_string*nullable dd_user_id_anonymize(zend_string *nonnull user_id);
+zend_string *nullable dd_user_info_anonymize(zend_string *nonnull user_info);
 
 user_collection_mode dd_get_user_collection_mode(void);
 zend_string *nonnull dd_get_user_collection_mode_zstr(void);
diff --git a/appsec/tests/extension/headers_collection_03.phpt b/appsec/tests/extension/headers_collection_03.phpt
index add14327c1..dcae368353 100644
--- a/appsec/tests/extension/headers_collection_03.phpt
+++ b/appsec/tests/extension/headers_collection_03.phpt
@@ -59,7 +59,7 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_signup_event("1234", [], false);
+track_user_signup_event("1234", []);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_04.phpt b/appsec/tests/extension/headers_collection_04.phpt
index bad781630a..0a61931e5d 100644
--- a/appsec/tests/extension/headers_collection_04.phpt
+++ b/appsec/tests/extension/headers_collection_04.phpt
@@ -59,7 +59,7 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_login_success_event("1234", [], false);
+track_user_login_success_event("1234", []);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_05.phpt b/appsec/tests/extension/headers_collection_05.phpt
index b0164b7d87..c6c53bc021 100644
--- a/appsec/tests/extension/headers_collection_05.phpt
+++ b/appsec/tests/extension/headers_collection_05.phpt
@@ -59,7 +59,7 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], false);
+track_user_login_failure_event("1234", true, ['email' => 'some@email.com']);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_06.phpt b/appsec/tests/extension/headers_collection_06.phpt
index 2b7ae5a853..71d78159ed 100644
--- a/appsec/tests/extension/headers_collection_06.phpt
+++ b/appsec/tests/extension/headers_collection_06.phpt
@@ -60,7 +60,7 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_signup_event("1234", [], true);
+track_user_signup_event("1234", []);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_07.phpt b/appsec/tests/extension/headers_collection_07.phpt
index 7dd33113f3..9f14d1b05a 100644
--- a/appsec/tests/extension/headers_collection_07.phpt
+++ b/appsec/tests/extension/headers_collection_07.phpt
@@ -60,7 +60,7 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_login_success_event("1234", [], true);
+track_user_login_success_event("1234", []);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_08.phpt b/appsec/tests/extension/headers_collection_08.phpt
index adf34edef3..7014da09fc 100644
--- a/appsec/tests/extension/headers_collection_08.phpt
+++ b/appsec/tests/extension/headers_collection_08.phpt
@@ -60,7 +60,7 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], true);
+track_user_login_failure_event("1234", true, ['email' => 'some@email.com']);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_09.phpt b/appsec/tests/extension/headers_collection_09.phpt
index f55f03e657..b17cd5e171 100644
--- a/appsec/tests/extension/headers_collection_09.phpt
+++ b/appsec/tests/extension/headers_collection_09.phpt
@@ -60,7 +60,7 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_signup_event("1234", [], true);
+track_user_signup_event("1234", []);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_10.phpt b/appsec/tests/extension/headers_collection_10.phpt
index ad6791bfa7..c24f3333b8 100644
--- a/appsec/tests/extension/headers_collection_10.phpt
+++ b/appsec/tests/extension/headers_collection_10.phpt
@@ -60,7 +60,7 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_login_success_event("1234", [], true);
+track_user_login_success_event("1234", []);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_11.phpt b/appsec/tests/extension/headers_collection_11.phpt
index c2c9104fd5..b5dd0630a0 100644
--- a/appsec/tests/extension/headers_collection_11.phpt
+++ b/appsec/tests/extension/headers_collection_11.phpt
@@ -60,7 +60,7 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], true);
+track_user_login_failure_event("1234", true, ['email' => 'some@email.com']);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_12.phpt b/appsec/tests/extension/headers_collection_12.phpt
index d93073d78e..a5fd0e092c 100644
--- a/appsec/tests/extension/headers_collection_12.phpt
+++ b/appsec/tests/extension/headers_collection_12.phpt
@@ -59,8 +59,8 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], false);
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], true);
+track_user_login_failure_event("1234", true, ['email' => 'some@email.com']);
+track_user_login_failure_event("1234", true, ['email' => 'some@email.com']);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/headers_collection_13.phpt b/appsec/tests/extension/headers_collection_13.phpt
index d32870831d..8c1c0d1bea 100644
--- a/appsec/tests/extension/headers_collection_13.phpt
+++ b/appsec/tests/extension/headers_collection_13.phpt
@@ -59,8 +59,8 @@ $helper = Helper::createInitedRun([
 rinit();
 $helper->get_commands(); //ignore
 
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], true);
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], false);
+track_user_login_failure_event("1234", true, ['email' => 'some@email.com']);
+track_user_login_failure_event("1234", true, ['email' => 'some@email.com']);
 
 rshutdown();
 $helper->get_commands(); //ignore
diff --git a/appsec/tests/extension/track_user_login_failure_event.phpt b/appsec/tests/extension/track_user_login_failure_event.phpt
index fef52ad536..4dfe46e083 100644
--- a/appsec/tests/extension/track_user_login_failure_event.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event.phpt
@@ -12,7 +12,7 @@ include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("Admin", false,
+track_user_login_failure_event("sdkID", false,
 [
     "value" => "something",
     "metadata" => "some other metadata",
@@ -34,13 +34,15 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => Admin
+    [appsec.events.users.login.failure.usr.id] => sdkID
+    [appsec.events.users.login.failure.usr.login] => sdkID
     [appsec.events.users.login.failure.track] => true
     [_dd.appsec.events.users.login.failure.sdk] => true
     [appsec.events.users.login.failure.value] => something
     [appsec.events.users.login.failure.metadata] => some other metadata
     [appsec.events.users.login.failure.email] => noneofyour@business.com
     [appsec.events.users.login.failure.usr.exists] => false
+    [server.business_logic.users.login.failure] => null
     [_dd.runtime_family] => php
     [_dd.p.dm] => -4
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode.phpt
index 8a5cd6ea96..16a991fb1e 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode.phpt
@@ -8,19 +8,18 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anon
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", 
+track_user_login_failure_event_automated("login", "automatedID",
     true,
     [
         "value" => "something",
         "metadata" => "some other metadata",
         "email" => "noneofyour@business.com"
     ]
-    , true
 );
 
 echo "root_span_get_meta():\n";
@@ -31,8 +30,12 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => anon_03ac674216f3e15c761ee1a5e255f067
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
     [_dd.appsec.events.users.login.failure.auto.mode] => anonymization
+    [appsec.events.users.login.failure.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_compat.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_compat.phpt
index bdc990bd65..293190a5fb 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_compat.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_compat.phpt
@@ -8,19 +8,18 @@ DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING=safe
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", 
+track_user_login_failure_event_automated("login", "automatedID",
     true,
     [
         "value" => "something",
         "metadata" => "some other metadata",
         "email" => "noneofyour@business.com"
     ]
-    , true
 );
 
 echo "root_span_get_meta():\n";
@@ -31,8 +30,12 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => anon_03ac674216f3e15c761ee1a5e255f067
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
     [_dd.appsec.events.users.login.failure.auto.mode] => anonymization
+    [appsec.events.users.login.failure.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_full_name.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_full_name.phpt
index 3996d5bbbd..d0fd9e515c 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_full_name.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_full_name.phpt
@@ -8,19 +8,18 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anonymization
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", 
+track_user_login_failure_event_automated("login", "automatedID",
     true,
     [
         "value" => "something",
         "metadata" => "some other metadata",
         "email" => "noneofyour@business.com"
     ]
-    , true
 );
 
 echo "root_span_get_meta():\n";
@@ -31,8 +30,12 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => anon_03ac674216f3e15c761ee1a5e255f067
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
     [_dd.appsec.events.users.login.failure.auto.mode] => anonymization
+    [appsec.events.users.login.failure.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_no_login.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_no_login.phpt
new file mode 100644
index 0000000000..e4710f2aae
--- /dev/null
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_no_login.phpt
@@ -0,0 +1,39 @@
+--TEST--
+Track automated user login failure with anonymization mode and verify the tags in the root span
+--INI--
+extension=ddtrace.so
+--ENV--
+DD_APPSEC_ENABLED=1
+DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anon
+--FILE--
+<?php
+use function datadog\appsec\testing\root_span_get_meta;
+use function datadog\appsec\track_user_login_failure_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_login_failure_event_automated("", "automatedID",
+    true,
+    [
+        "value" => "something",
+        "metadata" => "some other metadata",
+        "email" => "noneofyour@business.com"
+    ]
+);
+
+echo "root_span_get_meta():\n";
+print_r(root_span_get_meta());
+?>
+--EXPECTF--
+root_span_get_meta():
+Array
+(
+    [runtime-id] => %s
+    [appsec.events.users.login.failure.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.events.users.login.failure.auto.mode] => anonymization
+    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
+)
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_no_user.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_no_user.phpt
new file mode 100644
index 0000000000..716027115b
--- /dev/null
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_anon_mode_no_user.phpt
@@ -0,0 +1,39 @@
+--TEST--
+Track automated user login failure with anonymization mode and verify the tags in the root span
+--INI--
+extension=ddtrace.so
+--ENV--
+DD_APPSEC_ENABLED=1
+DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anon
+--FILE--
+<?php
+use function datadog\appsec\testing\root_span_get_meta;
+use function datadog\appsec\track_user_login_failure_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_login_failure_event_automated("login", "",
+    true,
+    [
+        "value" => "something",
+        "metadata" => "some other metadata",
+        "email" => "noneofyour@business.com"
+    ]
+);
+
+echo "root_span_get_meta():\n";
+print_r(root_span_get_meta());
+?>
+--EXPECTF--
+root_span_get_meta():
+Array
+(
+    [runtime-id] => %s
+    [_dd.appsec.events.users.login.failure.auto.mode] => anonymization
+    [appsec.events.users.login.failure.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
+)
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_default_mode.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_default_mode.phpt
index 532242aecb..af394e384f 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_default_mode.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_default_mode.phpt
@@ -7,12 +7,12 @@ DD_APPSEC_ENABLED=1
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", true, ['something' => 'discarded'], true);
+track_user_login_failure_event_automated("login", "automatedID", true, ['something' => 'discarded']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -22,8 +22,12 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => 1234
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => login
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_disabled_config.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_disabled_config.phpt
index f7c8285ee1..98c6fe3cb2 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_disabled_config.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_disabled_config.phpt
@@ -9,17 +9,17 @@ DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED=0
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("Admin", true,
+track_user_login_failure_event_automated("login", "automatedID", true,
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-], true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_disabled_mode.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_disabled_mode.phpt
index 6e55520b0c..40a2438fb6 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_disabled_mode.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_disabled_mode.phpt
@@ -8,17 +8,17 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=disabled
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("Admin", true,
+track_user_login_failure_event_automated("login", "automatedID", true,
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-], true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode.phpt
index ac7908d7bd..b2a775e867 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=ident
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], true);
+track_user_login_failure_event_automated("login", "automatedID", true, ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,8 +23,12 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => 1234
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => login
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_02.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_02.phpt
index 780034a358..a42829dec1 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_02.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_02.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=ident
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("sensitiveId", true, ['email' => 'some@email.com'], true);
+track_user_login_failure_event_automated("login", "automatedID", true, ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,8 +23,12 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => sensitiveId
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => login
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_compat.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_compat.phpt
index df397c733c..862e8c48ad 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_compat.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_compat.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING=extended
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], true);
+track_user_login_failure_event_automated("login", "automatedID", true, ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,8 +23,12 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => 1234
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => login
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_full_name.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_full_name.phpt
index 2796a3e5d9..a9eaf69a73 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_full_name.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_ident_mode_full_name.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=identification
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", true, ['email' => 'some@email.com'], true);
+track_user_login_failure_event_automated("login", "automatedID", true, ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,8 +23,12 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => 1234
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => login
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_invalid_mode.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_invalid_mode.phpt
index 98af06f8bc..bc27f6715f 100644
--- a/appsec/tests/extension/track_user_login_failure_event_automated_invalid_mode.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_invalid_mode.phpt
@@ -8,17 +8,17 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=invalid
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("Admin", true,
+track_user_login_failure_event_automated("login", "automatedID", true,
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-], true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_no_login.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_no_login.phpt
new file mode 100644
index 0000000000..cf058cebfd
--- /dev/null
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_no_login.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Track an automated user login failure event without login provided and verify the tags in the root span
+--INI--
+extension=ddtrace.so
+--ENV--
+DD_APPSEC_ENABLED=1
+--FILE--
+<?php
+use function datadog\appsec\testing\root_span_get_meta;
+use function datadog\appsec\track_user_login_failure_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_login_failure_event_automated("", "automatedID", false, []);
+
+echo "root_span_get_meta():\n";
+print_r(root_span_get_meta());
+?>
+--EXPECTF--
+root_span_get_meta():
+Array
+(
+    [runtime-id] => %s
+    [appsec.events.users.login.failure.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
+    [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.exists] => false
+    [server.business_logic.users.login.failure] => null
+)
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_no_root_span.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_no_root_span.phpt
new file mode 100644
index 0000000000..673aa594a0
--- /dev/null
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_no_root_span.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Track an automated user login failure event when no root span is available and verify the logs
+--INI--
+extension=ddtrace.so
+datadog.appsec.log_file=/tmp/php_appsec_test.log
+datadog.appsec.log_level=debug
+--ENV--
+DD_TRACE_GENERATE_ROOT_SPAN=0
+DD_APPSEC_ENABLED=1
+--FILE--
+<?php
+use function datadog\appsec\track_user_login_failure_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_login_failure_event_automated("login", "automatedID", false,
+[
+    "value" => "something",
+    "metadata" => "some other metadata",
+    "email" => "noneofyour@business.com"
+]);
+
+
+require __DIR__ . '/inc/logging.php';
+match_log("/No root span available on request init/");
+?>
+--EXPECTF--
+found message in log matching /No root span available on request init/
diff --git a/appsec/tests/extension/track_user_login_failure_event_automated_no_user.phpt b/appsec/tests/extension/track_user_login_failure_event_automated_no_user.phpt
new file mode 100644
index 0000000000..52f11bed3f
--- /dev/null
+++ b/appsec/tests/extension/track_user_login_failure_event_automated_no_user.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Track an automated user login failure event without user provided and verify the tags in the root span
+--INI--
+extension=ddtrace.so
+--ENV--
+DD_APPSEC_ENABLED=1
+--FILE--
+<?php
+use function datadog\appsec\testing\root_span_get_meta;
+use function datadog\appsec\track_user_login_failure_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_login_failure_event_automated("login", "", false, []);
+
+echo "root_span_get_meta():\n";
+print_r(root_span_get_meta());
+?>
+--EXPECTF--
+root_span_get_meta():
+Array
+(
+    [runtime-id] => %s
+    [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => login
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.exists] => false
+    [server.business_logic.users.login.failure] => null
+)
diff --git a/appsec/tests/extension/track_user_login_failure_event_existing_user.phpt b/appsec/tests/extension/track_user_login_failure_event_existing_user.phpt
index 60fbe15c89..21bbaa984d 100644
--- a/appsec/tests/extension/track_user_login_failure_event_existing_user.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_existing_user.phpt
@@ -12,7 +12,7 @@ include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("Admin", true,
+track_user_login_failure_event("sdkID", true,
 [
     "value" => "something",
     "metadata" => "some other metadata",
@@ -27,11 +27,13 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => Admin
+    [appsec.events.users.login.failure.usr.id] => sdkID
+    [appsec.events.users.login.failure.usr.login] => sdkID
     [appsec.events.users.login.failure.track] => true
     [_dd.appsec.events.users.login.failure.sdk] => true
     [appsec.events.users.login.failure.value] => something
     [appsec.events.users.login.failure.metadata] => some other metadata
     [appsec.events.users.login.failure.email] => noneofyour@business.com
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_no_root_span.phpt b/appsec/tests/extension/track_user_login_failure_event_no_root_span.phpt
index 87dcb81107..f05405dd5a 100644
--- a/appsec/tests/extension/track_user_login_failure_event_no_root_span.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_no_root_span.phpt
@@ -9,13 +9,12 @@ DD_TRACE_GENERATE_ROOT_SPAN=0
 DD_APPSEC_ENABLED=1
 --FILE--
 <?php
-use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_failure_event;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("Admin", false,
+track_user_login_failure_event("sdkID", false,
 [
     "value" => "something",
     "metadata" => "some other metadata",
diff --git a/appsec/tests/extension/track_user_login_failure_event_no_user.phpt b/appsec/tests/extension/track_user_login_failure_event_no_user.phpt
index ec10309588..01a80eee39 100644
--- a/appsec/tests/extension/track_user_login_failure_event_no_user.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_no_user.phpt
@@ -12,7 +12,7 @@ include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("", false, [], true);
+track_user_login_failure_event("", false, []);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,6 +23,7 @@ Array
 (
     [runtime-id] => %s
     [appsec.events.users.login.failure.track] => true
-    [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [_dd.appsec.events.users.login.failure.sdk] => true
     [appsec.events.users.login.failure.usr.exists] => false
+    [server.business_logic.users.login.failure] => null
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority.phpt b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority.phpt
index e5de6e72f3..209aa96e24 100644
--- a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority.phpt
@@ -8,12 +8,13 @@ DD_APPSEC_ENABLED=1
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("Admin", true, ["value" => "something-from-sdk"]); //Sdk
-track_user_login_failure_event("1234", false, ["value" => "something-from-automated"], true); //Automated
+track_user_login_failure_event("sdkID", true, ["value" => "something-from-sdk"]);
+track_user_login_failure_event_automated("login", "automatedID", false, ["value" => "something-from-automated"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,10 +24,14 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => Admin
+    [appsec.events.users.login.failure.usr.id] => sdkID
+    [appsec.events.users.login.failure.usr.login] => sdkID
     [appsec.events.users.login.failure.track] => true
     [_dd.appsec.events.users.login.failure.sdk] => true
     [appsec.events.users.login.failure.value] => something-from-sdk
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [_dd.appsec.usr.login] => login
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_02.phpt b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_02.phpt
index e0ed50ca3c..47c6264c06 100644
--- a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_02.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_02.phpt
@@ -8,12 +8,13 @@ DD_APPSEC_ENABLED=1
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", false, ["value" => "something-from-automated"], true); //Automated
-track_user_login_failure_event("Admin", true, ["value" => "something-from-sdk"]); //Sdk
+track_user_login_failure_event_automated("login", "automatedID", false, ["value" => "something-from-automated"]);
+track_user_login_failure_event("sdkID", true, ["value" => "something-from-sdk"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,10 +24,14 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => Admin
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => sdkID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => sdkID
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
     [_dd.appsec.events.users.login.failure.sdk] => true
     [appsec.events.users.login.failure.value] => something-from-sdk
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_03.phpt b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_03.phpt
index 7fc0ecbf69..c2f2414785 100644
--- a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_03.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_03.phpt
@@ -8,14 +8,15 @@ DD_APPSEC_ENABLED=1
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", false, ["value" => "something-from-automated"], true); //Automated
-track_user_login_failure_event("Admin", true, ["value" => "something-from-sdk"]); //Sdk
-track_user_login_failure_event("Other", true, ["value" => "something-from-sdk-2"]); //Sdk
-track_user_login_failure_event("4567", false, ["value" => "something-from-automated-2"], true); //Automated
+track_user_login_failure_event_automated("login", "automatedID", false, ["value" => "something-from-automated"]);
+track_user_login_failure_event("sdkID", true, ["value" => "something-from-sdk"]);
+track_user_login_failure_event("otherSdkID", true, ["value" => "something-from-sdk-2"]);
+track_user_login_failure_event_automated("otherLogin", "otherAutomatedID", false, ["value" => "something-from-automated-2"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -25,10 +26,14 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => Other
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => otherSdkID
+    [_dd.appsec.usr.id] => otherAutomatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => otherSdkID
+    [_dd.appsec.usr.login] => otherLogin
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
     [_dd.appsec.events.users.login.failure.sdk] => true
     [appsec.events.users.login.failure.value] => something-from-sdk-2
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_04.phpt b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_04.phpt
index bdef3bf6a1..d322b6ea78 100644
--- a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_04.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_04.phpt
@@ -9,12 +9,13 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=ident
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("Admin", true, ["value" => "something-from-sdk"]); //Sdk
-track_user_login_failure_event("1234", false, ["value" => "something-from-automated"], true); //Automated
+track_user_login_failure_event("sdkID", true, ["value" => "something-from-sdk"]);
+track_user_login_failure_event_automated("login", "automatedID", false, ["value" => "something-from-automated"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -24,10 +25,14 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => Admin
+    [appsec.events.users.login.failure.usr.id] => sdkID
+    [appsec.events.users.login.failure.usr.login] => sdkID
     [appsec.events.users.login.failure.track] => true
     [_dd.appsec.events.users.login.failure.sdk] => true
     [appsec.events.users.login.failure.value] => something-from-sdk
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [_dd.appsec.usr.login] => login
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_05.phpt b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_05.phpt
index bb5ca10fe7..efcb0488a0 100644
--- a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_05.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_05.phpt
@@ -9,12 +9,13 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=ident
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", false, ["value" => "something-from-automated"], true); //Automated
-track_user_login_failure_event("Admin", true, ["value" => "something-from-sdk"]); //Sdk
+track_user_login_failure_event_automated("login", "automatedID", false, ["value" => "something-from-automated"]);
+track_user_login_failure_event("sdkID", true, ["value" => "something-from-sdk"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -24,10 +25,14 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => Admin
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => sdkID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => sdkID
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
     [_dd.appsec.events.users.login.failure.sdk] => true
     [appsec.events.users.login.failure.value] => something-from-sdk
 )
diff --git a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_06.phpt b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_06.phpt
index 05a68b8fb5..714b00323e 100644
--- a/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_06.phpt
+++ b/appsec/tests/extension/track_user_login_failure_event_sdk_takes_priority_06.phpt
@@ -9,14 +9,15 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=ident
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_failure_event;
+use function datadog\appsec\track_user_login_failure_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_failure_event("1234", false, ["value" => "something-from-automated"], true); //Automated
-track_user_login_failure_event("Admin", true, ["value" => "something-from-sdk"]); //Sdk
-track_user_login_failure_event("Other", true, ["value" => "something-from-sdk-2"]); //Sdk
-track_user_login_failure_event("4567", false, ["value" => "something-from-automated-2"], true); //Automated
+track_user_login_failure_event_automated("login", "automatedID", false, ["value" => "something-from-automated"]);
+track_user_login_failure_event("sdkID", true, ["value" => "something-from-sdk"]);
+track_user_login_failure_event("otherSdkID", true, ["value" => "something-from-sdk-2"]);
+track_user_login_failure_event_automated("otherLogin", "otherAutomatedID", false, ["value" => "something-from-automated-2"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -26,10 +27,14 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [appsec.events.users.login.failure.usr.id] => Other
-    [appsec.events.users.login.failure.track] => true
+    [appsec.events.users.login.failure.usr.id] => otherSdkID
+    [_dd.appsec.usr.id] => otherAutomatedID
     [_dd.appsec.events.users.login.failure.auto.mode] => identification
+    [appsec.events.users.login.failure.usr.login] => otherSdkID
+    [_dd.appsec.usr.login] => otherLogin
+    [appsec.events.users.login.failure.track] => true
     [appsec.events.users.login.failure.usr.exists] => true
+    [server.business_logic.users.login.failure] => null
     [_dd.appsec.events.users.login.failure.sdk] => true
     [appsec.events.users.login.failure.value] => something-from-sdk-2
 )
diff --git a/appsec/tests/extension/track_user_login_success_event.phpt b/appsec/tests/extension/track_user_login_success_event.phpt
index ae3c5b2914..19ba5643cf 100644
--- a/appsec/tests/extension/track_user_login_success_event.phpt
+++ b/appsec/tests/extension/track_user_login_success_event.phpt
@@ -12,7 +12,7 @@ include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("Admin",
+track_user_login_success_event("sdkID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
@@ -34,12 +34,14 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => Admin
+    [usr.id] => sdkID
+    [appsec.events.users.login.success.usr.login] => sdkID
     [_dd.appsec.events.users.login.success.sdk] => true
     [appsec.events.users.login.success.value] => something
     [appsec.events.users.login.success.metadata] => some other metadata
     [appsec.events.users.login.success.email] => noneofyour@business.com
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
     [_dd.runtime_family] => php
     [_dd.p.dm] => -4
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_anon_mode.phpt b/appsec/tests/extension/track_user_login_success_event_automated_anon_mode.phpt
index e387d0e4c1..18fc1a68a6 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_anon_mode.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_anon_mode.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anon
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("admin", ['something' => 'discarded'], true);
+track_user_login_success_event_automated("login", "automatedID", ['something' => 'discarded']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => anon_8c6976e5b5410415bde908bd4dee15df
+    [usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
     [_dd.appsec.events.users.login.success.auto.mode] => anonymization
+    [appsec.events.users.login.success.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_compat.phpt b/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_compat.phpt
index d340fdd843..f305655286 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_compat.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_compat.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING=safe
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("admin", ['something' => 'discarded'], true);
+track_user_login_success_event_automated("login", "automatedID", ['something' => 'discarded']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => anon_8c6976e5b5410415bde908bd4dee15df
+    [usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
     [_dd.appsec.events.users.login.success.auto.mode] => anonymization
+    [appsec.events.users.login.success.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_full_name.phpt b/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_full_name.phpt
index 39ea6130c8..422fc7cc03 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_full_name.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_full_name.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anonymization
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("admin", ['something' => 'discarded'], true);
+track_user_login_success_event_automated("login", "automatedID", ['something' => 'discarded']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => anon_8c6976e5b5410415bde908bd4dee15df
+    [usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
     [_dd.appsec.events.users.login.success.auto.mode] => anonymization
+    [appsec.events.users.login.success.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_no_user.phpt b/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_no_user.phpt
new file mode 100644
index 0000000000..218c6c8f01
--- /dev/null
+++ b/appsec/tests/extension/track_user_login_success_event_automated_anon_mode_no_user.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Track automated user login success event with anonymization mode and verify the tags in the root span
+--INI--
+extension=ddtrace.so
+--ENV--
+DD_APPSEC_ENABLED=1
+DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anon
+--FILE--
+<?php
+use function datadog\appsec\testing\root_span_get_meta;
+use function datadog\appsec\track_user_login_success_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_login_success_event_automated("login", "", ['something' => 'discarded']);
+
+echo "root_span_get_meta():\n";
+print_r(root_span_get_meta());
+?>
+--EXPECTF--
+root_span_get_meta():
+Array
+(
+    [runtime-id] => %s
+    [_dd.appsec.events.users.login.success.auto.mode] => anonymization
+    [appsec.events.users.login.success.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
+)
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_default_mode.phpt b/appsec/tests/extension/track_user_login_success_event_automated_default_mode.phpt
index 1db2098598..a6cf689d5b 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_default_mode.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_default_mode.phpt
@@ -7,12 +7,12 @@ DD_APPSEC_ENABLED=1
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("1234", [], true);
+track_user_login_success_event_automated("login", "automatedID", []);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -22,7 +22,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => 1234
+    [usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.success.auto.mode] => identification
+    [appsec.events.users.login.success.usr.login] => login
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_disabled_config.phpt b/appsec/tests/extension/track_user_login_success_event_automated_disabled_config.phpt
index 236952150c..820f78a342 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_disabled_config.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_disabled_config.phpt
@@ -9,18 +9,17 @@ DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED=0
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("Admin",
+track_user_login_success_event_automated("login", "automatedID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-],
-true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_disabled_mode.phpt b/appsec/tests/extension/track_user_login_success_event_automated_disabled_mode.phpt
index a75e1bd8c9..31a6f1eaba 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_disabled_mode.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_disabled_mode.phpt
@@ -8,18 +8,17 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=disabled
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("Admin",
+track_user_login_success_event_automated("login", "automatedID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-],
-true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_empty_login.phpt b/appsec/tests/extension/track_user_login_success_event_automated_empty_login.phpt
new file mode 100644
index 0000000000..d92c7c82a4
--- /dev/null
+++ b/appsec/tests/extension/track_user_login_success_event_automated_empty_login.phpt
@@ -0,0 +1,32 @@
+--TEST--
+Track an automated user login success event with an empty user login and verify the logs
+--INI--
+extension=ddtrace.so
+datadog.appsec.log_file=/tmp/php_appsec_test.log
+datadog.appsec.log_level=debug
+--ENV--
+DD_APPSEC_ENABLED=1
+--FILE--
+<?php
+use function datadog\appsec\testing\root_span_get_meta;
+use function datadog\appsec\track_user_login_success_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_login_success_event_automated("", "automatedID",
+[
+    "value" => "something",
+    "metadata" => "some other metadata",
+    "email" => "noneofyour@business.com"
+]);
+
+echo "root_span_get_meta():\n";
+print_r(root_span_get_meta());
+?>
+--EXPECTF--
+root_span_get_meta():
+Array
+(
+    [runtime-id] => %s
+)
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_empty_user.phpt b/appsec/tests/extension/track_user_login_success_event_automated_empty_user.phpt
new file mode 100644
index 0000000000..50cc1d796c
--- /dev/null
+++ b/appsec/tests/extension/track_user_login_success_event_automated_empty_user.phpt
@@ -0,0 +1,37 @@
+--TEST--
+Track an automated user login success event with an empty user and verify the tags
+--INI--
+extension=ddtrace.so
+datadog.appsec.log_file=/tmp/php_appsec_test.log
+datadog.appsec.log_level=debug
+--ENV--
+DD_APPSEC_ENABLED=1
+--FILE--
+<?php
+use function datadog\appsec\testing\root_span_get_meta;
+use function datadog\appsec\track_user_login_success_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_login_success_event_automated("login", "",
+[
+    "value" => "something",
+    "metadata" => "some other metadata",
+    "email" => "noneofyour@business.com"
+]);
+
+echo "root_span_get_meta():\n";
+print_r(root_span_get_meta());
+?>
+--EXPECTF--
+root_span_get_meta():
+Array
+(
+    [runtime-id] => %s
+    [_dd.appsec.events.users.login.success.auto.mode] => identification
+    [appsec.events.users.login.success.usr.login] => login
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
+)
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_ident_mode.phpt b/appsec/tests/extension/track_user_login_success_event_automated_ident_mode.phpt
index a76fe0d5ee..74f5ab63be 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_ident_mode.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_ident_mode.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=ident
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("1234", ['email' => 'some@email.com'], true);
+track_user_login_success_event_automated("login", "automatedID", ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => 1234
+    [usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.success.auto.mode] => identification
+    [appsec.events.users.login.success.usr.login] => login
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_02.phpt b/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_02.phpt
index f9f2b469a3..aa3b7e1ed6 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_02.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_02.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=ident
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("sensitiveId", ['email' => 'some@email.com'], true);
+track_user_login_success_event_automated("login", "automatedID", ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => sensitiveId
+    [usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.success.auto.mode] => identification
+    [appsec.events.users.login.success.usr.login] => login
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_compat.phpt b/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_compat.phpt
index 88874a4d58..8c815f8c06 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_compat.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_compat.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING=extended
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("1234", ['email' => 'some@email.com'], true);
+track_user_login_success_event_automated("login", "automatedID", ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => 1234
+    [usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.success.auto.mode] => identification
+    [appsec.events.users.login.success.usr.login] => login
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_full_name.phpt b/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_full_name.phpt
index 156c884711..ecfbe6d5dc 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_full_name.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_ident_mode_full_name.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=identification
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("1234", ['email' => 'some@email.com'], true);
+track_user_login_success_event_automated("login", "automatedID", ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => 1234
+    [usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.success.auto.mode] => identification
+    [appsec.events.users.login.success.usr.login] => login
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_invalid_mode.phpt b/appsec/tests/extension/track_user_login_success_event_automated_invalid_mode.phpt
index e9972158e7..04db738fb4 100644
--- a/appsec/tests/extension/track_user_login_success_event_automated_invalid_mode.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_automated_invalid_mode.phpt
@@ -8,18 +8,17 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=invalid
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("Admin",
+track_user_login_success_event_automated("login", "automatedID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-],
-true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
diff --git a/appsec/tests/extension/track_user_login_success_event_automated_no_root_span.phpt b/appsec/tests/extension/track_user_login_success_event_automated_no_root_span.phpt
new file mode 100644
index 0000000000..89239d97fc
--- /dev/null
+++ b/appsec/tests/extension/track_user_login_success_event_automated_no_root_span.phpt
@@ -0,0 +1,32 @@
+--TEST--
+Track an automated user login success event when no root span is available and verify the logs
+--INI--
+extension=ddtrace.so
+datadog.appsec.log_file=/tmp/php_appsec_test.log
+datadog.appsec.log_level=debug
+--ENV--
+DD_TRACE_GENERATE_ROOT_SPAN=0
+DD_APPSEC_ENABLED=1
+--FILE--
+<?php
+
+use function datadog\appsec\track_user_login_success_event_automated;
+
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_login_success_event_automated("login", "automatedID",
+    [
+        "value" => "something",
+        "metadata" => "some other metadata",
+        "email" => "noneofyour@business.com"
+    ]
+);
+
+
+require __DIR__ . '/inc/logging.php';
+match_log("/No root span available on request init/");
+?>
+--EXPECTF--
+found message in log matching /No root span available on request init/
diff --git a/appsec/tests/extension/track_user_login_success_event_no_root_span.phpt b/appsec/tests/extension/track_user_login_success_event_no_root_span.phpt
index 9f0e7a17bf..218887b39a 100644
--- a/appsec/tests/extension/track_user_login_success_event_no_root_span.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_no_root_span.phpt
@@ -9,13 +9,12 @@ DD_TRACE_GENERATE_ROOT_SPAN=0
 DD_APPSEC_ENABLED=1
 --FILE--
 <?php
-use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_success_event;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("Admin",
+track_user_login_success_event("sdkID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
diff --git a/appsec/tests/extension/track_user_login_success_event_empty_user.phpt b/appsec/tests/extension/track_user_login_success_event_no_user.phpt
similarity index 92%
rename from appsec/tests/extension/track_user_login_success_event_empty_user.phpt
rename to appsec/tests/extension/track_user_login_success_event_no_user.phpt
index 168e5476e6..ad2e1630f9 100644
--- a/appsec/tests/extension/track_user_login_success_event_empty_user.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_no_user.phpt
@@ -8,7 +8,6 @@ datadog.appsec.log_level=debug
 DD_APPSEC_ENABLED=1
 --FILE--
 <?php
-use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_success_event;
 include __DIR__ . '/inc/ddtrace_version.php';
 
diff --git a/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority.phpt b/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority.phpt
index f1c2faed96..a33e34bdd7 100644
--- a/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority.phpt
@@ -8,12 +8,13 @@ DD_APPSEC_ENABLED=1
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("Admin", ["value" => "something-from-sdk"]); //Sdk
-track_user_login_success_event("1234", ["value" => "something-from-automated"], true); //Automated
+track_user_login_success_event("sdkID", ["value" => "something-from-sdk"]);
+track_user_login_success_event_automated("login",  "automatedID", ["value" => "something-from-automated"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,9 +24,13 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => Admin
+    [usr.id] => sdkID
+    [appsec.events.users.login.success.usr.login] => sdkID
     [_dd.appsec.events.users.login.success.sdk] => true
     [appsec.events.users.login.success.value] => something-from-sdk
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.success.auto.mode] => identification
+    [_dd.appsec.usr.login] => login
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority_02.phpt b/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority_02.phpt
index d21274d619..7c5a68be6f 100644
--- a/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority_02.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority_02.phpt
@@ -8,12 +8,13 @@ DD_APPSEC_ENABLED=1
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("1234", ["value" => "something-from-automated"], true); //Automated
-track_user_login_success_event("Admin", ["value" => "something-from-sdk"]); //Sdk
+track_user_login_success_event_automated("login", "automatedID", ["value" => "something-from-automated"]);
+track_user_login_success_event("sdkID", ["value" => "something-from-sdk"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,9 +24,13 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => Admin
+    [usr.id] => sdkID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.login.success.auto.mode] => identification
+    [appsec.events.users.login.success.usr.login] => sdkID
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
     [_dd.appsec.events.users.login.success.sdk] => true
     [appsec.events.users.login.success.value] => something-from-sdk
 )
diff --git a/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority_03.phpt b/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority_03.phpt
index 530f2ac8e4..66f1c96de3 100644
--- a/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority_03.phpt
+++ b/appsec/tests/extension/track_user_login_success_event_sdk_takes_priority_03.phpt
@@ -8,14 +8,15 @@ DD_APPSEC_ENABLED=1
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_login_success_event;
+use function datadog\appsec\track_user_login_success_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_login_success_event("1234", ["value" => "something-from-automated"], true); //Automated
-track_user_login_success_event("Admin", ["value" => "something-from-sdk"]); //Sdk
-track_user_login_success_event("OtherUser", ["value" => "something-from-sdk-2"]); //Sdk
-track_user_login_success_event("456", ["value" => "something-from-automated-2"], true); //Automated
+track_user_login_success_event_automated("login", "automatedID", ["value" => "something-from-automated"]);
+track_user_login_success_event("sdkID", ["value" => "something-from-sdk"]);
+track_user_login_success_event("otherSdkID", ["value" => "something-from-sdk-2"]);
+track_user_login_success_event_automated("otherLogin", "otherAutomatedID", ["value" => "something-from-automated-2"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -25,9 +26,13 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => OtherUser
+    [usr.id] => otherSdkID
+    [_dd.appsec.usr.id] => otherAutomatedID
     [_dd.appsec.events.users.login.success.auto.mode] => identification
+    [appsec.events.users.login.success.usr.login] => otherSdkID
+    [_dd.appsec.usr.login] => otherLogin
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
     [_dd.appsec.events.users.login.success.sdk] => true
     [appsec.events.users.login.success.value] => something-from-sdk-2
 )
diff --git a/appsec/tests/extension/track_user_signup_event.phpt b/appsec/tests/extension/track_user_signup_event.phpt
index ca2cfb0c8e..fbfb50635c 100644
--- a/appsec/tests/extension/track_user_signup_event.phpt
+++ b/appsec/tests/extension/track_user_signup_event.phpt
@@ -12,7 +12,7 @@ include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("Admin",
+track_user_signup_event("sdkID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
@@ -34,12 +34,14 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => Admin
+    [appsec.events.users.signup.usr.id] => sdkID
+    [appsec.events.users.signup.usr.login] => sdkID
     [_dd.appsec.events.users.signup.sdk] => true
     [appsec.events.users.signup.value] => something
     [appsec.events.users.signup.metadata] => some other metadata
     [appsec.events.users.signup.email] => noneofyour@business.com
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
     [_dd.runtime_family] => php
     [_dd.p.dm] => -4
 )
diff --git a/appsec/tests/extension/track_user_signup_event_automated_anon_mode.phpt b/appsec/tests/extension/track_user_signup_event_automated_anon_mode.phpt
index 0d7c26fb3a..c6925d359e 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_anon_mode.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_anon_mode.phpt
@@ -8,18 +8,17 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anon
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("1234",
+track_user_signup_event_automated("login", "automatedID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-],
-true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -29,7 +28,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => anon_03ac674216f3e15c761ee1a5e255f067
+    [appsec.events.users.signup.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
     [_dd.appsec.events.users.signup.auto.mode] => anonymization
+    [appsec.events.users.signup.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
 )
diff --git a/appsec/tests/extension/track_user_signup_event_automated_anon_mode_compat.phpt b/appsec/tests/extension/track_user_signup_event_automated_anon_mode_compat.phpt
index 1319f23d53..8536c86a63 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_anon_mode_compat.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_anon_mode_compat.phpt
@@ -8,18 +8,17 @@ DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING=safe
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("1234",
+track_user_signup_event_automated("login", "automatedID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-],
-true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -29,7 +28,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => anon_03ac674216f3e15c761ee1a5e255f067
+    [appsec.events.users.signup.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
     [_dd.appsec.events.users.signup.auto.mode] => anonymization
+    [appsec.events.users.signup.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
 )
diff --git a/appsec/tests/extension/track_user_signup_event_automated_anon_mode_full_name.phpt b/appsec/tests/extension/track_user_signup_event_automated_anon_mode_full_name.phpt
index 76fd4a6a55..bd057bcf6b 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_anon_mode_full_name.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_anon_mode_full_name.phpt
@@ -8,18 +8,17 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anonymization
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("1234",
+track_user_signup_event_automated("login", "automatedID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-],
-true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -29,7 +28,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => anon_03ac674216f3e15c761ee1a5e255f067
+    [appsec.events.users.signup.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
+    [_dd.appsec.usr.id] => anon_b3ddafd7029d645b44fb990eea55b003
     [_dd.appsec.events.users.signup.auto.mode] => anonymization
+    [appsec.events.users.signup.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
 )
diff --git a/appsec/tests/extension/track_user_signup_event_automated_anon_mode_no_user.phpt b/appsec/tests/extension/track_user_signup_event_automated_anon_mode_no_user.phpt
new file mode 100644
index 0000000000..5bebc99dcd
--- /dev/null
+++ b/appsec/tests/extension/track_user_signup_event_automated_anon_mode_no_user.phpt
@@ -0,0 +1,36 @@
+--TEST--
+Track automated user sign up event with anonymization mode and verify the tags in the root span
+--INI--
+extension=ddtrace.so
+--ENV--
+DD_APPSEC_ENABLED=1
+DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=anon
+--FILE--
+<?php
+use function datadog\appsec\testing\root_span_get_meta;
+use function datadog\appsec\track_user_signup_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_signup_event_automated("login", "",
+[
+    "value" => "something",
+    "metadata" => "some other metadata",
+    "email" => "noneofyour@business.com"
+]);
+
+echo "root_span_get_meta():\n";
+print_r(root_span_get_meta());
+?>
+--EXPECTF--
+root_span_get_meta():
+Array
+(
+    [runtime-id] => %s
+    [_dd.appsec.events.users.signup.auto.mode] => anonymization
+    [appsec.events.users.signup.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [_dd.appsec.usr.login] => anon_428821350e9691491f616b754cd8315f
+    [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
+)
diff --git a/appsec/tests/extension/track_user_signup_event_automated_default_mode.phpt b/appsec/tests/extension/track_user_signup_event_automated_default_mode.phpt
index bb544de19c..70dfa7a917 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_default_mode.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_default_mode.phpt
@@ -7,12 +7,12 @@ DD_APPSEC_ENABLED=1
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("1234", [], true);
+track_user_signup_event_automated("login", "automatedID", []);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -22,7 +22,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => 1234
+    [appsec.events.users.signup.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.signup.auto.mode] => identification
+    [appsec.events.users.signup.usr.login] => login
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
 )
diff --git a/appsec/tests/extension/track_user_signup_event_automated_disabled_config.phpt b/appsec/tests/extension/track_user_signup_event_automated_disabled_config.phpt
index 9e8ce5a750..fc1adb29f1 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_disabled_config.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_disabled_config.phpt
@@ -9,18 +9,17 @@ DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING_ENABLED=0
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("Admin",
+track_user_signup_event_automated("login", "automatedID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-],
-true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
diff --git a/appsec/tests/extension/track_user_signup_event_automated_disabled_mode.phpt b/appsec/tests/extension/track_user_signup_event_automated_disabled_mode.phpt
index 915b295a1d..d7a5ca4e09 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_disabled_mode.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_disabled_mode.phpt
@@ -8,18 +8,17 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=disabled
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("Admin",
+track_user_signup_event_automated("login", "automatedID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-],
-true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
diff --git a/appsec/tests/extension/track_user_signup_event_automated_empty_login.phpt b/appsec/tests/extension/track_user_signup_event_automated_empty_login.phpt
new file mode 100644
index 0000000000..dd9057c481
--- /dev/null
+++ b/appsec/tests/extension/track_user_signup_event_automated_empty_login.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Track an automated user login success event with an empty user login and verify the logs
+--INI--
+extension=ddtrace.so
+datadog.appsec.log_file=/tmp/php_appsec_test.log
+datadog.appsec.log_level=debug
+--ENV--
+DD_APPSEC_ENABLED=1
+--FILE--
+<?php
+use function datadog\appsec\track_user_signup_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_signup_event_automated("", "automatedID",
+[
+    "value" => "something",
+    "metadata" => "some other metadata",
+    "email" => "noneofyour@business.com"
+]);
+
+require __DIR__ . '/inc/logging.php';
+match_log("/Unexpected empty user login/");
+?>
+--EXPECTF--
+found message in log matching /Unexpected empty user login/
diff --git a/appsec/tests/extension/track_user_signup_event_automated_empty_user.phpt b/appsec/tests/extension/track_user_signup_event_automated_empty_user.phpt
new file mode 100644
index 0000000000..4906c6915e
--- /dev/null
+++ b/appsec/tests/extension/track_user_signup_event_automated_empty_user.phpt
@@ -0,0 +1,37 @@
+--TEST--
+Track an automated user login success event with an empty user and verify the logs
+--INI--
+extension=ddtrace.so
+datadog.appsec.log_file=/tmp/php_appsec_test.log
+datadog.appsec.log_level=debug
+--ENV--
+DD_APPSEC_ENABLED=1
+--FILE--
+<?php
+use function datadog\appsec\testing\root_span_get_meta;
+use function datadog\appsec\track_user_signup_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_signup_event_automated("login", "",
+[
+    "value" => "something",
+    "metadata" => "some other metadata",
+    "email" => "noneofyour@business.com"
+]);
+
+echo "root_span_get_meta():\n";
+print_r(root_span_get_meta());
+?>
+--EXPECTF--
+root_span_get_meta():
+Array
+(
+    [runtime-id] => %s
+    [_dd.appsec.events.users.signup.auto.mode] => identification
+    [appsec.events.users.signup.usr.login] => login
+    [_dd.appsec.usr.login] => login
+    [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
+)
diff --git a/appsec/tests/extension/track_user_signup_event_automated_ident_mode.phpt b/appsec/tests/extension/track_user_signup_event_automated_ident_mode.phpt
index 17e79fe0c6..bf06236236 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_ident_mode.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_ident_mode.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=ident
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("sensitiveId", ['email' => 'some@email.com'], true);
+track_user_signup_event_automated("login", "automatedID", ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => sensitiveId
+    [appsec.events.users.signup.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.signup.auto.mode] => identification
+    [appsec.events.users.signup.usr.login] => login
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
 )
diff --git a/appsec/tests/extension/track_user_signup_event_automated_ident_mode_compat.phpt b/appsec/tests/extension/track_user_signup_event_automated_ident_mode_compat.phpt
index ef68b6c59c..7b1fc7628f 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_ident_mode_compat.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_ident_mode_compat.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING=extended
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("sensitiveId", ['email' => 'some@email.com'], true);
+track_user_signup_event_automated("login", "automatedID", ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => sensitiveId
+    [appsec.events.users.signup.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.signup.auto.mode] => identification
+    [appsec.events.users.signup.usr.login] => login
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
 )
diff --git a/appsec/tests/extension/track_user_signup_event_automated_ident_mode_full_name.phpt b/appsec/tests/extension/track_user_signup_event_automated_ident_mode_full_name.phpt
index 9511cd5937..66928cec12 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_ident_mode_full_name.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_ident_mode_full_name.phpt
@@ -8,12 +8,12 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=identification
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("sensitiveId", ['email' => 'some@email.com'], true);
+track_user_signup_event_automated("login", "automatedID", ['email' => 'some@email.com']);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,7 +23,11 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => sensitiveId
+    [appsec.events.users.signup.usr.id] => automatedID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.signup.auto.mode] => identification
+    [appsec.events.users.signup.usr.login] => login
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
 )
diff --git a/appsec/tests/extension/track_user_signup_event_automated_invalid_mode.phpt b/appsec/tests/extension/track_user_signup_event_automated_invalid_mode.phpt
index 1dc84ac48b..f80e4557fa 100644
--- a/appsec/tests/extension/track_user_signup_event_automated_invalid_mode.phpt
+++ b/appsec/tests/extension/track_user_signup_event_automated_invalid_mode.phpt
@@ -8,18 +8,17 @@ DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE=invalid
 --FILE--
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
-use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("Admin",
+track_user_signup_event_automated("login", "automatedID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
     "email" => "noneofyour@business.com"
-],
-true);
+]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
diff --git a/appsec/tests/extension/track_user_signup_event_automated_no_root_span.phpt b/appsec/tests/extension/track_user_signup_event_automated_no_root_span.phpt
new file mode 100644
index 0000000000..356a698bc5
--- /dev/null
+++ b/appsec/tests/extension/track_user_signup_event_automated_no_root_span.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Track an automated user login success event when no root span is available and verify the logs
+--INI--
+extension=ddtrace.so
+datadog.appsec.log_file=/tmp/php_appsec_test.log
+datadog.appsec.log_level=debug
+--ENV--
+DD_TRACE_GENERATE_ROOT_SPAN=0
+DD_APPSEC_ENABLED=1
+--FILE--
+<?php
+use function datadog\appsec\track_user_signup_event_automated;
+include __DIR__ . '/inc/ddtrace_version.php';
+
+ddtrace_version_at_least('0.79.0');
+
+track_user_signup_event_automated("login", "automatedID",
+[
+    "value" => "something",
+    "metadata" => "some other metadata",
+    "email" => "noneofyour@business.com"
+]);
+
+
+require __DIR__ . '/inc/logging.php';
+match_log("/No root span available on request init/");
+?>
+--EXPECTF--
+found message in log matching /No root span available on request init/
diff --git a/appsec/tests/extension/track_user_signup_event_no_root_span.phpt b/appsec/tests/extension/track_user_signup_event_no_root_span.phpt
index 3e5d7270ed..bd8e63c724 100644
--- a/appsec/tests/extension/track_user_signup_event_no_root_span.phpt
+++ b/appsec/tests/extension/track_user_signup_event_no_root_span.phpt
@@ -9,13 +9,12 @@ DD_TRACE_GENERATE_ROOT_SPAN=0
 DD_APPSEC_ENABLED=1
 --FILE--
 <?php
-use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_signup_event;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("Admin",
+track_user_signup_event("sdkID",
 [
     "value" => "something",
     "metadata" => "some other metadata",
diff --git a/appsec/tests/extension/track_user_signup_event_empty_user.phpt b/appsec/tests/extension/track_user_signup_event_no_user.phpt
similarity index 92%
rename from appsec/tests/extension/track_user_signup_event_empty_user.phpt
rename to appsec/tests/extension/track_user_signup_event_no_user.phpt
index a5973f17b5..23bd0a60ec 100644
--- a/appsec/tests/extension/track_user_signup_event_empty_user.phpt
+++ b/appsec/tests/extension/track_user_signup_event_no_user.phpt
@@ -8,7 +8,6 @@ datadog.appsec.log_level=debug
 DD_APPSEC_ENABLED=1
 --FILE--
 <?php
-use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_signup_event;
 include __DIR__ . '/inc/ddtrace_version.php';
 
diff --git a/appsec/tests/extension/track_user_signup_event_sdk_takes_priority.phpt b/appsec/tests/extension/track_user_signup_event_sdk_takes_priority.phpt
index b80c3f8a75..62e82e0f34 100644
--- a/appsec/tests/extension/track_user_signup_event_sdk_takes_priority.phpt
+++ b/appsec/tests/extension/track_user_signup_event_sdk_takes_priority.phpt
@@ -8,12 +8,14 @@ DD_APPSEC_ENABLED=1
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
+
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("Admin", ["value" => "something-from-sdk"]); //Sdk
-track_user_signup_event("1234", ["value" => "something-from-automated"], true); //Automated
+track_user_signup_event("sdkID", ["value" => "something-from-sdk"]);
+track_user_signup_event_automated("login", "automatedID", ["value" => "something-from-automated"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,9 +25,13 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => Admin
+    [appsec.events.users.signup.usr.id] => sdkID
+    [appsec.events.users.signup.usr.login] => sdkID
     [_dd.appsec.events.users.signup.sdk] => true
     [appsec.events.users.signup.value] => something-from-sdk
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.signup.auto.mode] => identification
+    [_dd.appsec.usr.login] => login
 )
diff --git a/appsec/tests/extension/track_user_signup_event_sdk_takes_priority_02.phpt b/appsec/tests/extension/track_user_signup_event_sdk_takes_priority_02.phpt
index edd7d8612c..41c22b271f 100644
--- a/appsec/tests/extension/track_user_signup_event_sdk_takes_priority_02.phpt
+++ b/appsec/tests/extension/track_user_signup_event_sdk_takes_priority_02.phpt
@@ -8,12 +8,13 @@ DD_APPSEC_ENABLED=1
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("1234", ["value" => "something-from-automated"], true); //Automated
-track_user_signup_event("Admin", ["value" => "something-from-sdk"]); //Sdk
+track_user_signup_event_automated("login", "automatedID", ["value" => "something-from-automated"]);
+track_user_signup_event("sdkID", ["value" => "something-from-sdk"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -23,9 +24,13 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => Admin
+    [appsec.events.users.signup.usr.id] => sdkID
+    [_dd.appsec.usr.id] => automatedID
     [_dd.appsec.events.users.signup.auto.mode] => identification
+    [appsec.events.users.signup.usr.login] => sdkID
+    [_dd.appsec.usr.login] => login
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
     [_dd.appsec.events.users.signup.sdk] => true
     [appsec.events.users.signup.value] => something-from-sdk
 )
diff --git a/appsec/tests/extension/track_user_signup_event_sdk_takes_priority_03.phpt b/appsec/tests/extension/track_user_signup_event_sdk_takes_priority_03.phpt
index e84a564ead..ac9e006ffb 100644
--- a/appsec/tests/extension/track_user_signup_event_sdk_takes_priority_03.phpt
+++ b/appsec/tests/extension/track_user_signup_event_sdk_takes_priority_03.phpt
@@ -8,14 +8,15 @@ DD_APPSEC_ENABLED=1
 <?php
 use function datadog\appsec\testing\root_span_get_meta;
 use function datadog\appsec\track_user_signup_event;
+use function datadog\appsec\track_user_signup_event_automated;
 include __DIR__ . '/inc/ddtrace_version.php';
 
 ddtrace_version_at_least('0.79.0');
 
-track_user_signup_event("1234", ["value" => "something-from-automated"], true); //Automated
-track_user_signup_event("Admin", ["value" => "something-from-sdk"]); //Sdk
-track_user_signup_event("OtherUser", ["value" => "something-from-sdk-2"]); //Sdk
-track_user_signup_event("456", ["value" => "something-from-automated-2"], true); //Automated
+track_user_signup_event_automated("login", "automatedID", ["value" => "something-from-automated"]);
+track_user_signup_event("sdkID", ["value" => "something-from-sdk"]);
+track_user_signup_event("OtherSdkID", ["value" => "something-from-sdk-2"]);
+track_user_signup_event_automated("OtherLogin", "OtherAutomatedID", ["value" => "something-from-automated-2"]);
 
 echo "root_span_get_meta():\n";
 print_r(root_span_get_meta());
@@ -25,9 +26,13 @@ root_span_get_meta():
 Array
 (
     [runtime-id] => %s
-    [usr.id] => OtherUser
+    [appsec.events.users.signup.usr.id] => OtherSdkID
+    [_dd.appsec.usr.id] => OtherAutomatedID
     [_dd.appsec.events.users.signup.auto.mode] => identification
+    [appsec.events.users.signup.usr.login] => OtherSdkID
+    [_dd.appsec.usr.login] => OtherLogin
     [appsec.events.users.signup.track] => true
+    [server.business_logic.users.signup] => null
     [_dd.appsec.events.users.signup.sdk] => true
     [appsec.events.users.signup.value] => something-from-sdk-2
 )
diff --git a/appsec/tests/extension/user_tracking_do_nothing_from_login_success.phpt b/appsec/tests/extension/user_tracking_do_nothing_from_login_success.phpt
index cd5dae5df3..214c248b1e 100644
--- a/appsec/tests/extension/user_tracking_do_nothing_from_login_success.phpt
+++ b/appsec/tests/extension/user_tracking_do_nothing_from_login_success.phpt
@@ -47,9 +47,11 @@ Array
 (
     [runtime-id] => %s
     [usr.id] => Admin
+    [appsec.events.users.login.success.usr.login] => Admin
     [_dd.appsec.events.users.login.success.sdk] => true
     [appsec.events.users.login.success.value] => something
     [appsec.events.users.login.success.metadata] => some other metadata
     [appsec.events.users.login.success.email] => noneofyour@business.com
     [appsec.events.users.login.success.track] => true
+    [server.business_logic.users.login.success] => null
 )
diff --git a/appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/CommonTests.groovy b/appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/CommonTests.groovy
index 972ba03577..28d0dc315e 100644
--- a/appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/CommonTests.groovy
+++ b/appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/CommonTests.groovy
@@ -41,6 +41,37 @@ trait CommonTests {
         assert span.meta."usr.scope" == 'read:message, write:files'
     }
 
+    @Test
+    void 'user signup event'() {
+        Trace trace = container.traceFromRequest('/user_signup.php') { HttpResponse<InputStream> resp ->
+            assert resp.statusCode() == 200
+        }
+
+        Span span = trace.first()
+        assert span.metrics._sampling_priority_v1 == 2.0d
+        assert span.meta."appsec.events.users.signup.usr.id" == 'Admin'
+        assert span.meta."appsec.events.users.signup.usr.login" == 'Admin'
+        assert span.meta."appsec.events.users.signup.track" == 'true'
+        assert span.meta."appsec.events.users.signup.email" == 'jean.example@example.com'
+        assert span.meta."appsec.events.users.signup.session_id" == '987654321'
+        assert span.meta."appsec.events.users.signup.role" == 'admin'
+    }
+
+    @Test
+    void 'user signup event automated'() {
+        Trace trace = container.traceFromRequest('/user_signup_automated.php') { HttpResponse<InputStream> resp ->
+            assert resp.statusCode() == 200
+        }
+
+        Span span = trace.first()
+        assert span.metrics._sampling_priority_v1 == 2.0d
+        assert span.meta."appsec.events.users.signup.usr.id" == 'Admin'
+        assert span.meta."appsec.events.users.signup.usr.login" == 'Login'
+        assert span.meta."_dd.appsec.usr.id" == 'Admin'
+        assert span.meta."_dd.appsec.usr.login" == 'Login'
+        assert span.meta."appsec.events.users.signup.track" == 'true'
+    }
+
     @Test
     void 'user login success event'() {
         Trace trace = container.traceFromRequest('/user_login_success.php') { HttpResponse<InputStream> resp ->
@@ -50,12 +81,28 @@ trait CommonTests {
         Span span = trace.first()
         assert span.metrics._sampling_priority_v1 == 2.0d
         assert span.meta."usr.id" == 'Admin'
+        assert span.meta."appsec.events.users.login.success.usr.login" == 'Admin'
         assert span.meta."appsec.events.users.login.success.track" == 'true'
         assert span.meta."appsec.events.users.login.success.email" == 'jean.example@example.com'
         assert span.meta."appsec.events.users.login.success.session_id" == '987654321'
         assert span.meta."appsec.events.users.login.success.role" == 'admin'
     }
 
+    @Test
+    void 'user login success event automated'() {
+        Trace trace = container.traceFromRequest('/user_login_success_automated.php') { HttpResponse<InputStream> resp ->
+            assert resp.statusCode() == 200
+        }
+
+        Span span = trace.first()
+        assert span.metrics._sampling_priority_v1 == 2.0d
+        assert span.meta."usr.id" == 'Admin'
+        assert span.meta."appsec.events.users.login.success.usr.login" == 'Login'
+        assert span.meta."_dd.appsec.usr.id" == 'Admin'
+        assert span.meta."_dd.appsec.usr.login" == 'Login'
+        assert span.meta."appsec.events.users.login.success.track" == 'true'
+    }
+
     @Test
     void 'user login failure event'() {
         def trace = container.traceFromRequest('/user_login_failure.php') { HttpResponse<InputStream> resp ->
@@ -65,6 +112,7 @@ trait CommonTests {
         Span span = trace.first()
         assert span.metrics._sampling_priority_v1 == 2.0d
         assert span.meta."appsec.events.users.login.failure.usr.id" == 'Admin'
+        assert span.meta."appsec.events.users.login.failure.usr.login" == 'Admin'
         assert span.meta."appsec.events.users.login.failure.usr.exists" == 'false'
         assert span.meta."appsec.events.users.login.failure.track" == 'true'
         assert span.meta."appsec.events.users.login.failure.email" == 'jean.example@example.com'
@@ -72,6 +120,21 @@ trait CommonTests {
         assert span.meta."appsec.events.users.login.failure.role" == 'admin'
     }
 
+    @Test
+    void 'user login failure event automated'() {
+        def trace = container.traceFromRequest('/user_login_failure_automated.php') { HttpResponse<InputStream> resp ->
+            assert resp.statusCode() == 200
+        }
+
+        Span span = trace.first()
+        assert span.metrics._sampling_priority_v1 == 2.0d
+        assert span.meta."appsec.events.users.login.failure.usr.id" == 'Admin'
+        assert span.meta."_dd.appsec.usr.id" == 'Admin'
+        assert span.meta."_dd.appsec.usr.login" == 'Login'
+        assert span.meta."appsec.events.users.login.failure.usr.login" == 'Login'
+        assert span.meta."appsec.events.users.login.failure.usr.exists" == 'false'
+        assert span.meta."appsec.events.users.login.failure.track" == 'true'
+    }
 
     @Test
     void 'custom event'() {
diff --git a/appsec/tests/integration/src/test/www/base/public/user_login_failure_automated.php b/appsec/tests/integration/src/test/www/base/public/user_login_failure_automated.php
new file mode 100644
index 0000000000..d5ae21198a
--- /dev/null
+++ b/appsec/tests/integration/src/test/www/base/public/user_login_failure_automated.php
@@ -0,0 +1,9 @@
+<?php
+
+\datadog\appsec\track_user_login_failure_event_automated('Login', 'Admin', false, [
+    'email' => 'jean.example@example.com',
+    'session_id' => '987654321',
+    'role' => 'admin'
+]);
+
+echo "Automated User Login Failure";
diff --git a/appsec/tests/integration/src/test/www/base/public/user_login_success_automated.php b/appsec/tests/integration/src/test/www/base/public/user_login_success_automated.php
new file mode 100644
index 0000000000..dca7597bae
--- /dev/null
+++ b/appsec/tests/integration/src/test/www/base/public/user_login_success_automated.php
@@ -0,0 +1,13 @@
+<?php
+
+\datadog\appsec\track_user_login_success_event_automated(
+    $_GET['login'] ?? 'Login',
+    $_GET['id'] ?? 'Admin',
+    [
+        'email' => 'jean.example@example.com',
+        'session_id' => '987654321',
+        'role' => 'admin'
+    ]
+);
+
+echo "Automated User Login Success";
diff --git a/appsec/tests/integration/src/test/www/base/public/user_signup.php b/appsec/tests/integration/src/test/www/base/public/user_signup.php
new file mode 100644
index 0000000000..1c0aca527b
--- /dev/null
+++ b/appsec/tests/integration/src/test/www/base/public/user_signup.php
@@ -0,0 +1,8 @@
+<?php
+
+\datadog\appsec\track_user_signup_event("Admin", ['email' => 'jean.example@example.com',
+    'session_id' => '987654321',
+    'role' => 'admin'
+ ]);
+
+echo "User Signup";
diff --git a/appsec/tests/integration/src/test/www/base/public/user_signup_automated.php b/appsec/tests/integration/src/test/www/base/public/user_signup_automated.php
new file mode 100644
index 0000000000..e6bfd04408
--- /dev/null
+++ b/appsec/tests/integration/src/test/www/base/public/user_signup_automated.php
@@ -0,0 +1,8 @@
+<?php
+
+\datadog\appsec\track_user_signup_event_automated("Login", "Admin", ['email' => 'jean.example@example.com',
+    'session_id' => '987654321',
+    'role' => 'admin'
+ ]);
+
+echo "Automated User Signup";
diff --git a/src/DDTrace/Integrations/Laravel/LaravelIntegration.php b/src/DDTrace/Integrations/Laravel/LaravelIntegration.php
index 895a2bcfa7..7fd635d445 100644
--- a/src/DDTrace/Integrations/Laravel/LaravelIntegration.php
+++ b/src/DDTrace/Integrations/Laravel/LaravelIntegration.php
@@ -31,7 +31,7 @@ public function requiresExplicitTraceAnalyticsEnabling(): bool
         return false;
     }
 
-    public function isArtisanQueueCommand()
+    public function isArtisanQueueCommand(): bool
     {
         $artisanCommand = isset($_SERVER['argv'][1]) ? $_SERVER['argv'][1] : '';
 
@@ -93,7 +93,7 @@ function ($app) use ($integration) {
                         $config = require $configPath . '/app.php';
                         if (isset($config['name'])) {
                             $integration->serviceName = $config['name'];
-                        }                        
+                        }
                     }
                     if (empty($integration->serviceName)) {
                         $integration->serviceName = isset($_ENV['APP_NAME']) ? $_ENV['APP_NAME'] : 'Laravel';
@@ -193,18 +193,20 @@ function ($This, $scope, $args) use ($integration) {
                     if ($span->resource == 'eloquent.created: User') {
                         $authClass = 'User';
                         if (
-                            !function_exists('\datadog\appsec\track_user_signup_event') ||
+                            !function_exists('\datadog\appsec\track_user_signup_event_automated') ||
                             !isset($args[1]) ||
                             !$args[1] ||
                             !($args[1] instanceof $authClass)
                         ) {
                             return;
                         }
+
                         $id = null;
                         if (isset($args[1]['id'])) {
                             $id = $args[1]['id'];
                         }
-                        \datadog\appsec\track_user_signup_event($id, [], true);
+
+                        \datadog\appsec\track_user_signup_event_automated($integration->getLoginFromArgs($args[1]), $id, []);
                     }
                 },
                 'recurse' => true,
@@ -346,10 +348,11 @@ function ($exceptionHandler, $scope, $args) use ($integration) {
             'attempt',
             null,
             function ($This, $scope, $args, $loginSuccess) use ($integration) {
-                if ($loginSuccess || !function_exists('\datadog\appsec\track_user_login_failure_event')) {
+                if ($loginSuccess || !function_exists('\datadog\appsec\track_user_login_failure_event_automated')) {
                     return;
                 }
-                \datadog\appsec\track_user_login_failure_event(null, false, [], true);
+
+                \datadog\appsec\track_user_login_failure_event_automated($integration->getLoginFromArgs($args[0]), null, false, []);
             }
         );
 
@@ -360,24 +363,28 @@ function ($This, $scope, $args, $loginSuccess) use ($integration) {
             function ($This, $scope, $args) use ($integration) {
                 $authClass = 'Illuminate\Contracts\Auth\Authenticatable';
                 if (
-                    !function_exists('\datadog\appsec\track_user_login_success_event') ||
+                    !function_exists('\datadog\appsec\track_user_login_success_event_automated') ||
                     !isset($args[1]) ||
                     !$args[1] ||
                     !($args[1] instanceof $authClass)
                 ) {
                     return;
                 }
+
                 $metadata = [];
+
                 if (isset($args[1]['name'])) {
                     $metadata['name'] = $args[1]['name'];
                 }
+
                 if (isset($args[1]['email'])) {
                     $metadata['email'] = $args[1]['email'];
                 }
-                \datadog\appsec\track_user_login_success_event(
+
+                \datadog\appsec\track_user_login_success_event_automated(
+                    $integration->getLoginFromArgs($args[1]),
                     \method_exists($args[1], 'getAuthIdentifier') ? $args[1]->getAuthIdentifier() : '',
-                    $metadata,
-                    true
+                    $metadata
                 );
             }
         );
@@ -389,7 +396,7 @@ function ($This, $scope, $args) use ($integration) {
             function ($This, $scope, $args) use ($integration) {
                 $authClass = 'Illuminate\Auth\UserInterface';
                 if (
-                    !function_exists('\datadog\appsec\track_user_login_success_event') ||
+                    !function_exists('\datadog\appsec\track_user_login_success_event_automated') ||
                     !isset($args[0]) ||
                     !$args[0] ||
                     !($args[0] instanceof $authClass)
@@ -398,17 +405,19 @@ function ($This, $scope, $args) use ($integration) {
                 }
 
                 $metadata = [];
+
                 if (isset($args[0]['name'])) {
                     $metadata['name'] = $args[0]['name'];
                 }
+
                 if (isset($args[0]['email'])) {
                     $metadata['email'] = $args[0]['email'];
                 }
 
-                \datadog\appsec\track_user_login_success_event(
+                \datadog\appsec\track_user_login_success_event_automated(
+                    $integration->getLoginFromArgs($args[0]),
                     \method_exists($args[0], 'getAuthIdentifier') ? $args[0]->getAuthIdentifier() : '',
-                    $metadata,
-                    true
+                    $metadata
                 );
             }
         );
@@ -419,10 +428,11 @@ function ($This, $scope, $args) use ($integration) {
             'attempt',
             null,
             function ($This, $scope, $args, $loginSuccess) use ($integration) {
-                if ($loginSuccess || !function_exists('\datadog\appsec\track_user_login_failure_event')) {
+                if ($loginSuccess || !function_exists('\datadog\appsec\track_user_login_failure_event_automated')) {
                     return;
                 }
-                \datadog\appsec\track_user_login_failure_event(null, false, [], true);
+
+                \datadog\appsec\track_user_login_failure_event_automated($integration->getLoginFromArgs($args[0]), null, false, []);
             }
         );
 
@@ -433,17 +443,18 @@ function ($This, $scope, $args, $loginSuccess) use ($integration) {
             function ($This, $scope, $args) use ($integration) {
                 $authClass = 'Illuminate\Contracts\Auth\Authenticatable';
                 if (
-                    !function_exists('\datadog\appsec\track_user_signup_event') ||
+                    !function_exists('\datadog\appsec\track_user_signup_event_automated') ||
                     !isset($args[0]) ||
                     !$args[0] ||
                     !($args[0] instanceof $authClass)
                 ) {
                     return;
                 }
-                \datadog\appsec\track_user_signup_event(
+
+                \datadog\appsec\track_user_signup_event_automated(
+                    $integration->getLoginFromArgs($args[0]),
                     \method_exists($args[0], 'getAuthIdentifier') ? $args[0]->getAuthIdentifier() : '',
-                    [],
-                    true
+                    []
                 );
             }
         );
@@ -483,6 +494,21 @@ public function getServiceName()
         return $this->serviceName ?: 'laravel';
     }
 
+    /**
+     * @param $args
+     */
+    public function getLoginFromArgs($args): string
+    {
+        if (isset($args['email'])) {
+            return $args['email'];
+        }
+        if (isset($args['username'])) {
+            return $args['username'];
+        }
+
+        return null;
+    }
+
     /**
      * Tells whether a span is a lumen request.
      *
diff --git a/src/DDTrace/Integrations/Symfony/SymfonyIntegration.php b/src/DDTrace/Integrations/Symfony/SymfonyIntegration.php
index c633513ec0..b5d685aa91 100644
--- a/src/DDTrace/Integrations/Symfony/SymfonyIntegration.php
+++ b/src/DDTrace/Integrations/Symfony/SymfonyIntegration.php
@@ -88,7 +88,7 @@ public function init(): int
             'Doctrine\ORM\UnitOfWork',
             'executeInserts',
             function ($This, $scope, $args) {
-                if (!function_exists('\datadog\appsec\track_user_signup_event')) {
+                if (!function_exists('\datadog\appsec\track_user_signup_event_automated')) {
                     return;
                 }
 
@@ -117,7 +117,7 @@ function ($This, $scope, $args) {
                     $user = $userEntity->getUserIdentifier();
                 }
 
-                \datadog\appsec\track_user_signup_event($user, [], true);
+                \datadog\appsec\track_user_signup_event_automated($user, $user, []);
             }
         );
 
@@ -126,23 +126,26 @@ function ($This, $scope, $args) {
             'Symfony\Component\Security\Guard\Authenticator\AbstractFormLoginAuthenticator',
             'onAuthenticationSuccess',
             function ($This, $scope, $args) {
-                if (!function_exists('\datadog\appsec\track_user_login_success_event')) {
+                if (!function_exists('\datadog\appsec\track_user_login_success_event_automated')) {
                     return;
                 }
                 if (!isset($args[1])) {
                     return;
                 }
+
                 $token = $args[1];
                 $authClass = '\Symfony\Component\Security\Core\Authentication\Token\TokenInterface';
                 if (!$token || !($token instanceof $authClass)) {
                     return;
                 }
+
                 $metadata = [];
+                $user = \method_exists($token, 'getUsername') ? $token->getUsername() : '';
 
-                \datadog\appsec\track_user_login_success_event(
-                    \method_exists($token, 'getUsername') ? $token->getUsername() : '',
-                    $metadata,
-                    true
+                \datadog\appsec\track_user_login_success_event_automated(
+                    $user,
+                    $user,
+                    $metadata
                 );
             }
         );
@@ -152,10 +155,10 @@ function ($This, $scope, $args) {
             'Symfony\Component\Security\Guard\Authenticator\AbstractFormLoginAuthenticator',
             'onAuthenticationFailure',
             function ($This, $scope, $args) {
-                if (!function_exists('\datadog\appsec\track_user_login_failure_event')) {
+                if (!function_exists('\datadog\appsec\track_user_login_failure_event_automated')) {
                     return;
                 }
-                \datadog\appsec\track_user_login_failure_event(null, false, [], true);
+                \datadog\appsec\track_user_login_failure_event_automated(null, null, false, []);
             }
         );
 
@@ -164,10 +167,10 @@ function ($This, $scope, $args) {
             'Symfony\Component\Security\Http\Firewall\AbstractAuthenticationListener',
             'onFailure',
             function ($This, $scope, $args) {
-                if (!function_exists('\datadog\appsec\track_user_login_failure_event')) {
+                if (!function_exists('\datadog\appsec\track_user_login_failure_event_automated')) {
                     return;
                 }
-                \datadog\appsec\track_user_login_failure_event(null, false, [], true);
+                \datadog\appsec\track_user_login_failure_event_automated(null, null, false, []);
             }
         );
 
@@ -176,7 +179,7 @@ function ($This, $scope, $args) {
             'Symfony\Component\Security\Http\Firewall\AbstractAuthenticationListener',
             'onSuccess',
             function ($This, $scope, $args) {
-                if (!function_exists('\datadog\appsec\track_user_login_success_event')) {
+                if (!function_exists('\datadog\appsec\track_user_login_success_event_automated')) {
                     return;
                 }
                 if (!isset($args[1])) {
@@ -189,11 +192,12 @@ function ($This, $scope, $args) {
                 }
 
                 $metadata = [];
+                $user = \method_exists($token, 'getUsername') ? $token->getUsername() : '';
 
-                \datadog\appsec\track_user_login_success_event(
-                    \method_exists($token, 'getUsername') ? $token->getUsername() : '',
-                    $metadata,
-                    true
+                \datadog\appsec\track_user_login_success_event_automated(
+                    $user,
+                    $user,
+                    $metadata
                 );
             }
         );
@@ -203,10 +207,10 @@ function ($This, $scope, $args) {
             'Symfony\Component\Security\Http\Authenticator\FormLoginAuthenticator',
             'onAuthenticationFailure',
             function ($This, $scope, $args) {
-                if (!function_exists('\datadog\appsec\track_user_login_failure_event')) {
+                if (!function_exists('\datadog\appsec\track_user_login_failure_event_automated')) {
                     return;
                 }
-                \datadog\appsec\track_user_login_failure_event(null, false, [], true);
+                \datadog\appsec\track_user_login_failure_event_automated(null, null, false, []);
             }
         );
 
@@ -215,7 +219,7 @@ function ($This, $scope, $args) {
             'Symfony\Component\Security\Http\Authenticator\FormLoginAuthenticator',
             'onAuthenticationSuccess',
             function ($This, $scope, $args) {
-                if (!function_exists('\datadog\appsec\track_user_login_success_event')) {
+                if (!function_exists('\datadog\appsec\track_user_login_success_event_automated')) {
                     return;
                 }
                 if (!isset($args[1])) {
@@ -226,17 +230,20 @@ function ($This, $scope, $args) {
                 if (!$token || !($token instanceof $authClass)) {
                     return;
                 }
-                $metadata = [];
 
                 $user = \method_exists($token, 'getUser') ? $token->getUser() : null;
                 $userClass = '\Symfony\Component\Security\Core\User\UserInterface';
                 if (!$user || !($user instanceof $userClass)) {
                     return;
                 }
-                \datadog\appsec\track_user_login_success_event(
-                    \method_exists($user, 'getUserIdentifier') ? $user->getUserIdentifier() : '',
-                    $metadata,
-                    true
+
+                $metadata = [];
+                $userIdentifier = \method_exists($user, 'getUserIdentifier') ? $user->getUserIdentifier() : '';
+
+                \datadog\appsec\track_user_login_success_event_automated(
+                    $userIdentifier,
+                    $userIdentifier,
+                    $metadata
                 );
             }
         );
diff --git a/src/DDTrace/Integrations/WordPress/WordPressIntegration.php b/src/DDTrace/Integrations/WordPress/WordPressIntegration.php
index afd79ccef0..ce8a00b1be 100644
--- a/src/DDTrace/Integrations/WordPress/WordPressIntegration.php
+++ b/src/DDTrace/Integrations/WordPress/WordPressIntegration.php
@@ -69,11 +69,17 @@ function_exists('is_404') && is_404() === false) {
         \DDTrace\hook_function(
             'wp_authenticate',
             null,
-            function ($par, $retval) {
+            function ($args, $retval) {
                 $userClass = '\WP_User';
+
+                $username = null;
+                if (isset($args[0])) {
+                    $username = $args[0];
+                }
+
                 if (!($retval instanceof $userClass)) {
                     //Login failed
-                    if (!function_exists('\datadog\appsec\track_user_login_failure_event')) {
+                    if (!function_exists('\datadog\appsec\track_user_login_failure_event_automated')) {
                         return;
                     }
                     $errorClass = '\WP_Error';
@@ -82,14 +88,15 @@ function ($par, $retval) {
                         is_array($retval->errors) &&
                         isset($retval->errors['incorrect_password']);
 
-                    $usernameUsed = isset($_POST['log']) ? $_POST['log'] : '';
-                    \datadog\appsec\track_user_login_failure_event($usernameUsed, $exists, [], true);
+                    \datadog\appsec\track_user_login_failure_event_automated($username, $username, $exists, []);
                     return;
                 }
+
                 //From this moment on, login is succesful
-                if (!function_exists('\datadog\appsec\track_user_login_success_event')) {
+                if (!function_exists('\datadog\appsec\track_user_login_success_event_automated')) {
                     return;
                 }
+
                 $data = \property_exists($retval, 'data') ? $retval->data : null;
 
                 $id = \property_exists($data, 'ID') ? $data->ID : null;
@@ -101,10 +108,11 @@ function ($par, $retval) {
                 if (\property_exists($data, 'display_name')) {
                     $metadata['name'] = $data->display_name;
                 }
-                \datadog\appsec\track_user_login_success_event(
+
+                \datadog\appsec\track_user_login_success_event_automated(
+                    $username,
                     $id,
-                    $metadata,
-                    true
+                    $metadata
                 );
             }
         );
@@ -114,24 +122,31 @@ function ($par, $retval) {
             'register_new_user',
             null,
             function ($args, $retval) {
-                if (!function_exists('\datadog\appsec\track_user_signup_event')) {
+                if (!function_exists('\datadog\appsec\track_user_signup_event_automated')) {
                     return;
                 }
+
                 $errorClass = '\WP_Error';
                 if ($retval instanceof $errorClass) {
                     return;
                 }
+
                 $metadata = [];
+                $login = null;
+
                 if (isset($args[0])) {
                     $metadata['username'] = $args[0];
+                    $login = $args[0];
                 }
+
                 if (isset($args[1])) {
                     $metadata['email'] = $args[1];
                 }
-                \datadog\appsec\track_user_signup_event(
+
+                \datadog\appsec\track_user_signup_event_automated(
+                    $login,
                     $retval,
-                    $metadata,
-                    true
+                    $metadata
                 );
             }
         );
diff --git a/tests/Appsec/Mock.php b/tests/Appsec/Mock.php
index e90dedfc45..99b7876c89 100644
--- a/tests/Appsec/Mock.php
+++ b/tests/Appsec/Mock.php
@@ -3,12 +3,13 @@
 namespace datadog\appsec;
 
 if (!class_exists('datadog\appsec\AppsecStatus')) {
-    class AppsecStatus {
-
+    class AppsecStatus
+    {
         private static $instance = null;
         private $connection;
 
-        protected function __construct() {
+        protected function __construct()
+        {
         }
 
         public static function getInstance()
@@ -87,62 +88,119 @@ public function getEvents(array $names = [], array $addresses = [])
 }
 
 if (!function_exists('datadog\appsec\appsecMockEnabled')) {
-    function appsecMockEnabled() {
+    function appsecMockEnabled()
+    {
         return getenv('APPSEC_MOCK_ENABLED') === "true";
     }
 }
 
+if (!function_exists('datadog\appsec\track_user_login_success_event_automated')) {
+    /**
+     * This function is exposed by appsec but here we are mocking it for tests
+     */
+    function track_user_login_success_event_automated($userLogin, $userId, $metadata)
+    {
+        if (!appsecMockEnabled()) {
+            return;
+        }
+        $event = [
+            'userLogin' => $userLogin,
+            'userId' => $userId,
+            'metadata' => $metadata,
+
+        ];
+        AppsecStatus::getInstance()->addEvent($event, 'track_user_login_success_event_automated');
+    }
+}
+
 if (!function_exists('datadog\appsec\track_user_login_success_event')) {
     /**
      * This function is exposed by appsec but here we are mocking it for tests
      */
-    function track_user_login_success_event($userId, $metadata, $automated) {
-        if(!appsecMockEnabled()) {
+    function track_user_login_success_event($userId, $metadata)
+    {
+        if (!appsecMockEnabled()) {
             return;
         }
         $event = [
             'userId' => $userId,
             'metadata' => $metadata,
-            'automated' => $automated
 
         ];
         AppsecStatus::getInstance()->addEvent($event, 'track_user_login_success_event');
     }
 }
 
-if (!function_exists('datadog\appsec\track_user_login_failure_event')) {
+if (!function_exists('datadog\appsec\track_user_login_failure_event_automated')) {
     /**
      * This function is exposed by appsec but here we are mocking it for tests
      */
-    function track_user_login_failure_event($userId, $exists, $metadata, $automated) {
-        if(!appsecMockEnabled()) {
+    function track_user_login_failure_event_automated($userLogin, $userId, $exists, $metadata)
+    {
+        if (!appsecMockEnabled()) {
             return;
         }
         $event = [
+            'userLogin' => $userLogin,
             'userId' => $userId,
             'exists' => $exists,
             'metadata' => $metadata,
-            'automated' => $automated
 
         ];
+        AppsecStatus::getInstance()->addEvent($event, 'track_user_login_failure_event_automated');
+    }
+}
+
+if (!function_exists('datadog\appsec\track_user_login_failure_event')) {
+    /**
+     * This function is exposed by appsec but here we are mocking it for tests
+     */
+    function track_user_login_failure_event($userId, $exists, $metadata)
+    {
+        if (!appsecMockEnabled()) {
+            return;
+        }
+        $event = [
+            'userId' => $userId,
+            'exists' => $exists,
+            'metadata' => $metadata,
+        ];
         AppsecStatus::getInstance()->addEvent($event, 'track_user_login_failure_event');
     }
 }
 
-if (!function_exists('datadog\appsec\track_user_signup_event')) {
+if (!function_exists('datadog\appsec\track_user_signup_event_automated')) {
     /**
      * This function is exposed by appsec but here we are mocking it for tests
      */
-    function track_user_signup_event($userId, $metadata, $automated) {
-        if(!appsecMockEnabled()) {
+    function track_user_signup_event_automated($userLogin, $userId, $metadata)
+    {
+        if (!appsecMockEnabled()) {
             return;
         }
         $event = [
+            'userLogin' => $userLogin,
             'userId' => $userId,
             'metadata' => $metadata,
-            'automated' => $automated
 
         ];
+        AppsecStatus::getInstance()->addEvent($event, 'track_user_signup_event_automated');
+    }
+}
+
+if (!function_exists('datadog\appsec\track_user_signup_event')) {
+    /**
+     * This function is exposed by appsec but here we are mocking it for tests
+     */
+    function track_user_signup_event($userId, $metadata)
+    {
+        if (!appsecMockEnabled()) {
+            return;
+        }
+        $event = [
+            'userId' => $userId,
+            'metadata' => $metadata,
+        ];
         AppsecStatus::getInstance()->addEvent($event, 'track_user_signup_event');
     }
 }
@@ -152,9 +210,10 @@ function track_user_signup_event($userId, $metadata, $automated) {
      * This function is exposed by appsec but here we are mocking it for tests
      * @param array $params
      */
-    function push_address($key, $value, $rasp = false) {
-        if(!appsecMockEnabled()) {
-           return;
+    function push_address($key, $value, $rasp = false)
+    {
+        if (!appsecMockEnabled()) {
+            return;
         }
         AppsecStatus::getInstance()->addEvent(['rasp' => $rasp, $key => $value], 'push_address');
     }
diff --git a/tests/Integrations/Laravel/AutomatedLoginEventsTestSuite.php b/tests/Integrations/Laravel/AutomatedLoginEventsTestSuite.php
index dc05a4ae87..26ae0c9341 100644
--- a/tests/Integrations/Laravel/AutomatedLoginEventsTestSuite.php
+++ b/tests/Integrations/Laravel/AutomatedLoginEventsTestSuite.php
@@ -29,7 +29,8 @@ protected function login($email)
         );
     }
 
-    protected function createUser($id, $name, $email) {
+    protected function createUser($id, $name, $email)
+    {
         //Password is password
         $this->connection()->exec("insert into users (id, name, email, password) VALUES (".$id.", '".$name."', '".$email."', '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi')");
     }
@@ -43,12 +44,12 @@ public function testUserLoginSuccessEvent()
 
         $this->login($email);
 
-        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_success_event']);
+        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_success_event_automated']);
         $this->assertEquals(1, count($events));
         $this->assertEquals($id, $events[0]['userId']);
+        $this->assertEquals($email, $events[0]['userLogin']);
         $this->assertEquals($name, $events[0]['metadata']['name']);
         $this->assertEquals($email, $events[0]['metadata']['email']);
-        $this->assertTrue($events[0]['automated']);
     }
 
     public function testUserLoginFailureEvent()
@@ -57,9 +58,9 @@ public function testUserLoginFailureEvent()
 
         $this->login($email);
 
-        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_failure_event']);
+        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_failure_event_automated']);
         $this->assertEquals(1, count($events));
-        $this->assertTrue($events[0]['automated']);
+        $this->assertEquals($email, $events[0]['userLogin']);
     }
 
     public function testUserSignUp()
@@ -68,18 +69,18 @@ public function testUserSignUp()
         $name = 'somename';
         $password = 'somepassword';
 
-       $this->call(
-           GetSpec::create('Signup', sprintf('/login/signup?email=%s&name=%s&password=%s',$email, $email, $password))
-       );
+        $this->call(
+            GetSpec::create('Signup', sprintf('/login/signup?email=%s&name=%s&password=%s', $email, $name, $password))
+        );
 
-       $users = $this->connection()->query("SELECT * FROM users where email='".$email."'")->fetchAll();
+        $users = $this->connection()->query("SELECT * FROM users where email='".$email."'")->fetchAll();
 
         $this->assertEquals(1, count($users));
 
-        $signUpEvent = AppsecStatus::getInstance()->getEvents(['track_user_signup_event']);
+        $signUpEvent = AppsecStatus::getInstance()->getEvents(['track_user_signup_event_automated']);
 
-        $this->assertTrue($signUpEvent[0]['automated']);
         $this->assertEquals($users[0]['id'], $signUpEvent[0]['userId']);
+        $this->assertEquals($users[0]['email'], $signUpEvent[0]['userLogin']);
     }
 
     public function testLoggedInCalls()
@@ -98,7 +99,10 @@ public function testLoggedInCalls()
         $this->call(GetSpec::create('Behind auth', '/behind_auth'));
 
         $events = AppsecStatus::getInstance()->getEvents([
-            'track_user_login_success_event','track_user_login_failure_event', 'track_user_signup_event']);
+            'track_user_login_success_event_automated',
+            'track_user_login_failure_event_automated',
+            'track_user_signup_event_automated'
+        ]);
         $this->assertEquals(0, count($events)); //Auth does not generate appsec events
         $this->disableSession();
     }
diff --git a/tests/Integrations/Symfony/AutomatedLoginEventsTestSuite.php b/tests/Integrations/Symfony/AutomatedLoginEventsTestSuite.php
index e413f90953..41ebff3fc4 100644
--- a/tests/Integrations/Symfony/AutomatedLoginEventsTestSuite.php
+++ b/tests/Integrations/Symfony/AutomatedLoginEventsTestSuite.php
@@ -41,12 +41,12 @@ public function testUserLoginSuccessEvent()
 
          $this->call($spec, [ CURLOPT_FOLLOWLOCATION => false ]);
 
-         $events = AppsecStatus::getInstance()->getEvents(['track_user_login_success_event']);
+         $events = AppsecStatus::getInstance()->getEvents(['track_user_login_success_event_automated']);
 
          $this->assertEquals(1, count($events));
+         $this->assertEquals($email, $events[0]['userLogin']);
          $this->assertEquals($email, $events[0]['userId']);
          $this->assertEmpty($events[0]['metadata']);
-         $this->assertTrue($events[0]['automated']);
     }
 
     public function testUserLoginFailureEvent()
@@ -59,11 +59,11 @@ public function testUserLoginFailureEvent()
 
          $this->call($spec, [ CURLOPT_FOLLOWLOCATION => false ]);
 
-         $events = AppsecStatus::getInstance()->getEvents(['track_user_login_failure_event']);
+         $events = AppsecStatus::getInstance()->getEvents(['track_user_login_failure_event_automated']);
          $this->assertEquals(1, count($events));
+         $this->assertEmpty($events[0]['userLogin']);
          $this->assertEmpty($events[0]['userId']);
          $this->assertEmpty($events[0]['metadata']);
-         $this->assertTrue($events[0]['automated']);
     }
 
     public function getSignUpPayload($email, $password) {
@@ -72,21 +72,22 @@ public function getSignUpPayload($email, $password) {
 
     public function testUserSignUp()
     {
-       $email = 'test-user@email.com';
-       $password = 'some password';
-       $spec = PostSpec::create('Signup', '/register', [
-                       'Content-Type: application/x-www-form-urlencoded'
-                   ], $this->getSignUpPayload($email, $password));
+        $email = 'test-user@email.com';
+        $password = 'some password';
+        $spec = PostSpec::create('Signup', '/register', [
+                        'Content-Type: application/x-www-form-urlencoded'
+                    ], $this->getSignUpPayload($email, $password));
 
-       $this->call($spec, [ CURLOPT_FOLLOWLOCATION => false ]);
+        $this->call($spec, [ CURLOPT_FOLLOWLOCATION => false ]);
 
-       $users = $this->getUser($email);
+        $users = $this->getUser($email);
 
         $this->assertEquals(1, count($users));
 
-        $signUpEvent = AppsecStatus::getInstance()->getEvents(['track_user_signup_event']);
+        $signUpEvent = AppsecStatus::getInstance()->getEvents(['track_user_signup_event_automated']);
 
-        $this->assertTrue($signUpEvent[0]['automated']);
+        $this->assertEquals($email, $signUpEvent[0]['userLogin']);
         $this->assertEquals($email, $signUpEvent[0]['userId']);
+        $this->assertEmpty($signUpEvent[0]['metadata']);
     }
 }
diff --git a/tests/Integrations/WordPress/AutomatedLoginEventsTestSuite.php b/tests/Integrations/WordPress/AutomatedLoginEventsTestSuite.php
index 54e04c3b0d..dfd282657c 100644
--- a/tests/Integrations/WordPress/AutomatedLoginEventsTestSuite.php
+++ b/tests/Integrations/WordPress/AutomatedLoginEventsTestSuite.php
@@ -7,7 +7,7 @@
 use DDTrace\Tests\Frameworks\Util\Request\GetSpec;
 use datadog\appsec\AppsecStatus;
 
- /**
+/**
  * @group appsec
  */
 class AutomatedLoginEventsTestSuite extends AppsecTestCase
@@ -35,14 +35,14 @@ public function testUserLoginSuccessEvent()
             'Content-Type: application/x-www-form-urlencoded'
         ], "log=$email&pwd=$password&wp-submit=Log In");
 
-        $this->call($spec, [ CURLOPT_FOLLOWLOCATION => false, CURLOPT_COOKIESESSION => true ]);
+        $this->call($spec, [CURLOPT_FOLLOWLOCATION => false, CURLOPT_COOKIESESSION => true]);
 
-        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_success_event']);
+        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_success_event_automated']);
         $this->assertEquals(1, count($events));
+        $this->assertEquals($email, $events[0]['userLogin']);
         $this->assertEquals($id, $events[0]['userId']);
         $this->assertEquals($email, $events[0]['metadata']['email']);
         $this->assertEquals($name, $events[0]['metadata']['name']);
-        $this->assertTrue($events[0]['automated']);
     }
 
     public function testUserLoginFailureEventWhenUserDoesNotExists()
@@ -50,17 +50,17 @@ public function testUserLoginFailureEventWhenUserDoesNotExists()
         $email = 'non-existing@email.com';
         $password = 'some password';
         $spec = PostSpec::create('request', '/wp-login.php', [
-                    'Content-Type: application/x-www-form-urlencoded'
-                ], "log=$email&pwd=$password&wp-submit=Log In");
+            'Content-Type: application/x-www-form-urlencoded'
+        ], "log=$email&pwd=$password&wp-submit=Log In");
 
-        $this->call($spec, [ CURLOPT_FOLLOWLOCATION => false, CURLOPT_COOKIESESSION => true ]);
+        $this->call($spec, [CURLOPT_FOLLOWLOCATION => false, CURLOPT_COOKIESESSION => true]);
 
-        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_failure_event']);
+        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_failure_event_automated']);
         $this->assertEquals(1, count($events));
         $this->assertEquals($email, $events[0]['userId']);
+        $this->assertEquals($email, $events[0]['userLogin']);
         $this->assertFalse($events[0]['exists']);
         $this->assertEmpty($events[0]['metadata']);
-        $this->assertTrue($events[0]['automated']);
     }
 
     public function testUserLoginFailureEventWhenUserDoesExists()
@@ -78,14 +78,14 @@ public function testUserLoginFailureEventWhenUserDoesExists()
             'Content-Type: application/x-www-form-urlencoded'
         ], "log=$email&pwd=invalid&wp-submit=Log In");
 
-        $this->call($spec, [ CURLOPT_FOLLOWLOCATION => false, CURLOPT_COOKIESESSION => true ]);
+        $this->call($spec, [CURLOPT_FOLLOWLOCATION => false, CURLOPT_COOKIESESSION => true]);
 
-        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_failure_event']);
+        $events = AppsecStatus::getInstance()->getEvents(['track_user_login_failure_event_automated']);
         $this->assertEquals(1, count($events));
         $this->assertEquals($email, $events[0]['userId']);
+        $this->assertEquals($email, $events[0]['userLogin']);
         $this->assertTrue($events[0]['exists']);
         $this->assertEmpty($events[0]['metadata']);
-        $this->assertTrue($events[0]['automated']);
     }
 
     public function testUserSignUp()
@@ -93,21 +93,21 @@ public function testUserSignUp()
         $email = 'test-user-signup@email.com';
         $username = 'someusername';
 
-       $this->call(
-           PostSpec::create('request', '/wp-login.php?action=register', [
-               'Content-Type: application/x-www-form-urlencoded'
-           ], "user_login=$username&user_email=$email&wp-submit=Register&redirect_to=")
-       );
+        $this->call(
+            PostSpec::create('request', '/wp-login.php?action=register', [
+                'Content-Type: application/x-www-form-urlencoded'
+            ], "user_login=$username&user_email=$email&wp-submit=Register&redirect_to=")
+        );
 
-       $users = $this->connection()->query("SELECT * FROM ".$this->users_table." where user_email='".$email."'")->fetchAll();
+        $users = $this->connection()->query("SELECT * FROM ".$this->users_table." where user_email='".$email."'")->fetchAll();
 
-       $this->assertEquals(1, count($users));
+        $this->assertEquals(1, count($users));
 
-       $signUpEvent = AppsecStatus::getInstance()->getEvents(['track_user_signup_event']);
+        $signUpEvent = AppsecStatus::getInstance()->getEvents(['track_user_signup_event_automated']);
 
-       $this->assertTrue($signUpEvent[0]['automated']);
-       $this->assertEquals($users[0]['ID'], $signUpEvent[0]['userId']);
-       $this->assertEquals($users[0]['user_login'], $signUpEvent[0]['metadata']['username']);
-       $this->assertEquals($users[0]['user_email'], $signUpEvent[0]['metadata']['email']);
+        $this->assertEquals($users[0]['ID'], $signUpEvent[0]['userId']);
+        $this->assertEquals($users[0]['user_login'], $signUpEvent[0]['userLogin']);
+        $this->assertEquals($users[0]['user_login'], $signUpEvent[0]['metadata']['username']);
+        $this->assertEquals($users[0]['user_email'], $signUpEvent[0]['metadata']['email']);
     }
 }