You may want to look at some of the audit dashboards in ES and consider using them as a starting point for the correlation search you want to write. For example, the Search Audit dashboard has a panel that calculates run time, but it contains the search itself as well as the user and time. Drilling into it you can see that is uses the macro search_activity and then works on that to format the output and calculate time. You could potentially use that as a starting point and tweak to look at activity that a specific account name, like admin is doing. Correlation searches do not need to use data models though it makes a lot of sense to in most cases when dealing with sensors and endpoints that can be heterogenous.
You can create correlation search as per your requirement, however there aren't any data models which you can use for this. For admin activities you should be able to get data from _internal index.
The _ indexes (_internal, _audit) are often not available to standard users...also they are not searched by default so try the index=_internal and see if anything appears, if not run a query to check what index access you have...
