Tune and complete risk/observable matching feature

[cmcginley-splunk]

• Alongside risk message validation we added the beginnings of some code which can match risk events against observables
• We should complete this feature