For sending security related events to a SIEM solution you could use text filters in addition to the appname filter.
This list will cover all the security specific logs but must be entered manually:
*password was changed*
*logged out*
*cannot login*
*logged in*
*rejected password for user*
*Permission rule removed*
*DCUI has been enabled*
*Firewall configuration has changed*
*Permission created*