Press CTRL+K to open search

Process events

  • Published on Sep 3, 2026
  • 1 minute(s) read
Prev Next

The most reliable method to process events from the events API is to use a pagination cursor from the after parameter. This method ensures that events aren't skipped or duplicated due to the lack of time stamp precision.

These are the general sequence of steps to follow when applying the after parameter:

  1. Issue an initial request using the request parameters and since with a value set to a date in the last 60 minutes.

  2. Retrieve the next page of events through the Link response header value within the next link relationship.

  3. Issue the paginated request.

  4. Pause and repeat step 2.

Note

If there is no next link in the response header, you have received all events for the time period specified in the original request.

Related articles
  • Process incidents with the after parameter
    Data Loss Prevention (DLP) > Data Loss Prevention SaaS > Trellix Data Loss Prevention - SaaS Product Guide - February 2026 > DLP SaaS Incident APIs > Workflow to retrieve threat events of the type incidents using Events API call > REST API call to retrieve events of the type incidents using Events API
  • Event request
    Network Security (NX) > Common Security Platform Product Docs > API Reference Release 2025.1 > Endpoints > Events
  • Request parameters
    ePolicy Orchestrator - SaaS > Trellix ePolicy Orchestrator - SaaS Product Guide > Events API