Support alerts on audit logs

OpenSearch is used to store and search large volumes of data. OpenSearch audit logs maintain a record of user activity of the system. In conjunction with appropriate tools and procedures, audit logs can provide a means to help accomplish several security-related objectives, including individual accountability, reconstruction of events, intrusion detection, and problem analysis [NIST-CSRC (https://csrc.nist.gov/csrc/media/publications/shared/documents/itl-bulletin/itlbul1997-03.txt)].
Provide an out-of-box solution that helps OpenSearch administrators to analyze Users activity. The first version (P0) of this project is completely out-of-box and doesn’t require any new release of OpenSearch. This solution provides new dashboards that gets insights into Users activity, a set of monitors that create alerts based on abnormal User activity, and a set of Saved Queries for ad-hoc exploration.

The issue mentions dashboards, monitors, and Saved Queries but names no files, tests, or entry points. Start by locating the existing audit-log integrations and related security analytics resources; done means an out-of-box solution provides user-activity dashboards, abnormal-activity alerts, and Saved Queries without requiring a new OpenSearch release.