1. An apparatus comprising: at least a first processing device comprising a processor coupled to a memory and implementing a given application comprising one or more remote components of a remote portion of a distributed security information and event management (SIEM) system, at least a subset of the remote components of the remote portion of the distributed SIEM system being configured for interaction with a centralized portion of the distributed SIEM system implemented on at least a second processing device distinct from the first processing device; at least one of the remote components of the remote portion of the distributed SIEM system being configured: to specify one or more reporting conditions, the one or more reporting conditions comprising allowable conditions within the given application that would not otherwise trigger generation of alerts in the distributed SIEM system absent specification of the one or more reporting conditions; to perform one or more local correlations of allowable application-specific transactions utilizing information locally accessible within the given application responsive to detecting one or more of the reporting conditions and utilizing results of one or more local correlations performed by one or more additional ones of the remote components of the remote portion of the distributed SIEM system, the results of the one or more local correlations performed by the one or more additional remote components providing situational awareness for authorization policy checks specific to the given application to take into account activity occurring in one or more additional applications; to deliver results of the one or more local correlations from the remote portion of the distributed SIEM system to the centralized portion of the distributed SIEM system; and to dynamically alter processing within the given application based at least in part on (i) the results of the one or more local correlations performed by said at least one remote component for the given application and (ii) the results of the one or more local correlations performed by at least one of the additional remote components for at least one of the additional applications; wherein the at least one remote component is configured to perform the one or more local correlations utilizing an application-specific domain model comprising application-specific objects and application-specific object state transitions relevant in the context of the given application but not represented in application-independent activity logs of the given application sent to the centralized portion of the distributed SIEM system; wherein the application specific domain model represents conditions within the context of the given application defined using semantics of the given application; and wherein the at least one remote component is configured to perform the one or more local correlations utilizing correlation rules representing particular relationships between the application-specific objects and particular application-specific object state transitions.