short_lived_windows_accounts.yml adding risk to user

[jwindley-splunk]

Can we not get the 'src_user' (from the Account Management dataset) in the results of the search? This would be more useful to add risk to rather than the target user account name that was created/deleted

[josehelps]

Hey @jwindley-splunk mind pointing me back to specific searches/detections you had in mind for this issue?