Download a CSV file with event information

You can download a CSV file with events in an events table. Each event table shows the latest 500 events. However, you can download a CSV file to see up to 5,000 of the most recent events based on the dimension and filters you selected.

To download a CSV file with event information:

For threat or access control events, in the Threat Protection menu of Enterprise Center, select Reports > Threat Events or Reports > Access Control.
For Security Connector events, in the Threat Protection menu of Enterprise Center, select Reports > Security Connector.
Filter the events as needed. For more information see Filter data based on date and time and Filter event data.
If you haven't done so already, select a dimension or event criteria.
In the grouped events area, click the arrow icon to show the events associated with the selected dimension.
Click Download CSV (All Events) to download the events that are associated with the dimension you selected.