Windows User managment events - Events 4720-4722-4723-4724-4725-4726-4738-4740-4767

This is great!

It will be released in 7.4 (probably mid to late Sept), but you don't need to wait for a release to open a pull request. The code is all in the master branch so you can make modifications from that branch.

Regarding event.category and event.action for these user management events, I think having detailed action value would be useful (maybe something like user-created, user-enabled, etc). For the category I can get back to you, or just open a PR and we can get feedback from the folks working on ECS. We recently were discussing what the first set of event.category values would be.