Audit log watch

Flag suspicious activity

Not built yet. This will poll the Enterprise Grid audit log (Grid-only, via auditlogs:read) for bulk downloads, unusual logins, and privilege escalation.