Update audit logging section

jpipkin1 · jpipkin1 · commit 4fe3f23aef57 · 2025-02-06T16:06:51.000-06:00
diff --git a/docs/manage/security/service-accounts.md b/docs/manage/security/service-accounts.md
@@ -66,4 +66,6 @@ Service account events are recorded in the Audit Event Index as user events. To
 _index=sumologic_audit_events _sourceCategory=users
 ```
 
+Service account events will return with `subsystem` shown as `serviceAccounts`.
+
 For more information about audit logging, see [Audit Event Index](/docs/manage/security/audit-indexes/audit-event-index/).
