Distributed Security Information and Event Management System with Application-Injected Remote Components

A distributed security information and event management system comprises a centralized portion and a plurality of remote portions, with the remote portions being implemented in respective applications within information technology infrastructure. Each of the remote portions comprises one or more remote components inserted into the corresponding application. At least a subset of the remote components of the remote portion are configured for interaction with one or more corresponding centralized components of the centralized portion of the system. The remote components may each be configured to process one or more specified eXtensible Access Control Markup Language (XACML) Obligations or other constructs.