A security analyst is configuring a Linux syslog server to forward only the most critical events to the SIEM to reduce noise and ensure high-priority conditions are escalated immediately. The organization wants to capture messages indicating that a system is unusable or that immediate action is required, but exclude routine informational and debugging entries. According to the standard syslog severity scale, which severity levels should the analyst configure to be forwarded to the SIEM for immediate escalation?