Backport 1325 to 2.4

[engechas]

Issue #, if available: opensearch-project/security-analytics#718

Description of changes:
Manually resolves backport of #1325

CheckList:

• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (2a85f26) 76.28% compared to head (ebc6901) 76.15%.

Additional details and impacted files

@@             Coverage Diff              @@
##                2.4    #1376      +/-   ##
============================================
- Coverage     76.28%   76.15%   -0.14%     
  Complexity      116      116              
============================================
  Files           124      124              
  Lines          6617     6618       +1     
  Branches        982      983       +1     
============================================
- Hits           5048     5040       -8     
- Misses         1068     1080      +12     
+ Partials        501      498       -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.