Awarz 650 elastalert rules

[aarz-snl]

🗣 Description

#650

💭 Motivation and context

One elastalert rule that monitors Kibana alert index.

🧪 Testing

Install LME, turn on Windows Alerts in kibana security, setup the ElastAlert rule, trigger an alert (event log cleared)

See included .md file for directions

✅ Pre-approval checklist

• Changes are limited to a single goal AND
  the title reflects this in a clear human readable format
• Issue that this PR solves has been selected in the Development section
• I have read and agree to LME's CONTRIBUTING.md document.
• The PR adheres to LME's requirements in RELEASES.md
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.

✅ Pre-merge Checklist

• All tests pass
• PR has been tested and the documentation for testing is above
• Squash and merge all commits into one PR level commit

✅ Post-merge Checklist

• Delete the branch to keep down number of branches