Cloud Secure Edge Docs

CSE Home>  Visibility and Logging>  Events>  Export and Retain Events

Export and Retain Events

Keep a long-term copy of Cloud Secure Edge (CSE) events in your SIEM, log platform, or archive storage
Updated On: Oct 02, 2026
On This Page

Overview

The Cloud Secure Edge (CSE) Command Center retains events for 14 days. Organizations that need events for compliance, incident investigation, or long-term analysis should export them continuously to a system they control.

Every export option in this section reads from the same Events API. The API returns events as JSON, supports filtering by time window and severity, and pages through large result sets so that each event is retrieved exactly once.

Choose an export method

MethodBest forGuide
Filebeat and the ELK StackOrganizations that already run Elasticsearch and Kibana. Filebeat polls the API, tracks its own position, and indexes events directly.Forward CSE Events to the ELK Stack
Your own scriptAny other SIEM (for example Splunk, Microsoft Sentinel, or QRadar), object storage, or a data lake. A scheduled script pulls new events and writes them wherever your pipeline expects them.Retrieve Events with the API
Python library and CLIOne-off pulls and ad hoc investigation from a terminal.Python Library and CLI

What every method needs

  • A read-only API key. Create it in the Command Center under Settings > API Keys with the ReadOnly scope. See Authentication with API Key and API Key Privilege Levels.
  • A checkpoint. Store the created_at timestamp of the newest event you have already received, and ask the API only for events after it on the next poll.
  • A polling interval shorter than the retention window. Polling every 5 to 15 minutes is typical. Any interval under a few hours is safe.
  • Deduplication on the event id. Every event carries a unique id. Deduplicating on it in your destination system is an inexpensive safety net.

Next steps