Send logs that have a local scope, that is they only contain information of an event that occurred in a machine that is not linked to an external connection.

Identify the logs that are generated locally in the SIEM.

Classify the logs for different applications and store them in different files.

Identify the logs generated by local users.