Security applications for audit logs

There's potential to use the audit logger data to train an ML model that can generate alerts when unusual / suspicious activity occurs on the site at a user level.

Given our servers are locked down to the extent that a large proportion of potential exploits are mitigated authenticated exploits are something worth noting, eg. privilege escalation or anomalous access to large amounts of data.

Approx 20% of recent WP core security patches were to fix authenticated exploits: https://wpvulndb.com/wordpresses

Some ideas regarding data that would then be useful to store in the audit log might be:

- User roles & caps
- Function call trace, just names? Maybe not, expensive to run, lot of extra data