diff --git a/internal/pkg/es/mapping.go b/internal/pkg/es/mapping.go
index 0a45abfba..ee48f060f 100644
--- a/internal/pkg/es/mapping.go
+++ b/internal/pkg/es/mapping.go
@@ -32,6 +32,9 @@ const (
 		},
 		"type": {
 			"type": "keyword"
+		},
+		"user_id": {
+			"type": "keyword"
 		}		
 	}
 }`
diff --git a/internal/pkg/model/schema.go b/internal/pkg/model/schema.go
index 389c2fa30..ee8357fea 100644
--- a/internal/pkg/model/schema.go
+++ b/internal/pkg/model/schema.go
@@ -53,6 +53,9 @@ type Action struct {
 
 	// The action type. INPUT_ACTION is the value for the actions that suppose to be routed to the endpoints/beats.
 	Type string `json:"type,omitempty"`
+
+	// The ID of the user who created the action.
+	UserId string `json:"user_id,omitempty"`
 }
 
 // ActionData The opaque payload.
diff --git a/model/schema.json b/model/schema.json
index 9dcfe3d38..43a09c525 100644
--- a/model/schema.json
+++ b/model/schema.json
@@ -38,6 +38,10 @@
           "description": "The input type the actions should be routed to.",
           "type": "string"
         },
+        "user_id": {
+          "description": "The ID of the user who created the action.",
+          "type": "string"
+        },
         "agents": {
           "description": "The Agent IDs the action is intended for. No support for json.RawMessage with the current generator. Could be useful to lazy parse the agent ids",
           "type": "array",