GWS events flowing into the SIEM pipeline so partners can search and investigate GWS identity events alongside M365. Includes ECS field mapping for GWS events and starter SIEM queries.