Hi @markbrook try the solution marked in this link i have created an Manger correlation rule to get the service accounts.
HTH.