Backport 1325 to 2.1

[engechas]

Issue #, if available: opensearch-project/security-analytics#718

Description of changes:
Manually resolves backport of #1325

CheckList:

• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (6018a4f) 76.80% compared to head (1b92347) 76.89%.

Additional details and impacted files

@@             Coverage Diff              @@
##                2.1    #1379      +/-   ##
============================================
+ Coverage     76.80%   76.89%   +0.08%     
  Complexity      176      176              
============================================
  Files           166      166              
  Lines          8372     8373       +1     
  Branches       1233     1234       +1     
============================================
+ Hits           6430     6438       +8     
+ Misses         1337     1327      -10     
- Partials        605      608       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.