Add m365_defender.incident.alerts.evidence.user_account.display_name to related.user.

Author: chrisberkhout

packages/m365_defender/data_stream/incident/elasticsearch/ingest_pipeline/default.yml

@@ -1550,6 +1550,15 @@ processors:
           field: _ingest._value.userAccount.displayName
           target_field: _ingest._value.user_account.display_name
           ignore_missing: true
+  - foreach:
+      field: json.alerts.evidence
+      if: ctx.json?.alerts?.evidence instanceof List
+      processor:
+        append:
+          field: related.user
+          value: '{{{_ingest._value.user_account.display_name}}}'
+          allow_duplicates: false
+          ignore_failure: true
   - foreach:
       field: json.alerts.evidence
       if: ctx.json?.alerts?.evidence instanceof List