Cyberdyne Systems' security team needs to centralize CloudWatch logs from all its AWS accounts into a single logging account for processing and streaming to their security information and event management (SIEM) tool, while logs must stay within their originating AWS Region. Given varying log volumes throughout the day and an existing AWS Control Tower environment, which set of steps should a solutions architect take to design a scalable solution for aggregating, normalizing, and streaming logs to the SIEM tool? (Choose three.)