Backport 1325 to 2.8

[engechas]

Issue #, if available: opensearch-project/security-analytics#718

Description of changes:
Manually resolves backport of #1325

CheckList:

• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (b887104) 75.18% compared to head (a1262ca) 75.40%.
Report is 1 commits behind head on 2.8.

Additional details and impacted files

@@             Coverage Diff              @@
##                2.8    #1372      +/-   ##
============================================
+ Coverage     75.18%   75.40%   +0.22%     
  Complexity      116      116              
============================================
  Files           141      141              
  Lines          8422     8426       +4     
  Branches       1204     1206       +2     
============================================
+ Hits           6332     6354      +22     
+ Misses         1480     1463      -17     
+ Partials        610      609       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.