Currently we have audit logs being shipped to splunk.

We need to alert when someone logs in local login.

Currently we can't do that because audit logs do not explicit state with the login is via SSO or local login.

Can harness add a Local Login action so we can then alert on this.