{"id":7364,"date":"2026-05-25T10:40:18","date_gmt":"2026-05-25T07:40:18","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&#038;p=7364"},"modified":"2026-10-19T13:11:50","modified_gmt":"2026-10-19T10:11:50","slug":"guidance-for-using-the-elements-api-and-the-security-events-endpoint","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/jp-ja\/announcements\/guidance-for-using-the-elements-api-and-the-security-events-endpoint\/","title":{"rendered":"Guidance for using the Elements API and the Security Events endpoint"},"content":{"rendered":"<p>We have observed that some of our partners and customers are calling the Security Events endpoint of the Elements API, requesting several years of event data.<\/p>\n<p>This can cause an increased data processing load for the API consumer, and will also affect them in the longer term. Read on for more details.<\/p>\n<p>This is creating an abnormal load on our API, which can be impactful to both WithSecure and our other customers.<\/p>\n<h2 data-id=\"facts\"><strong>Facts<\/strong><\/h2>\n<ul>\n<li>Older Security Events are never updated, so if you have retrieved them once there is no need to retrieve them again. Retrieving them again incurs bandwidth usage and processing cycles both for you and for WithSecure.<\/li>\n<li>We have a limitation of 30 days of Security Events per request, although this is not currently enforced. From the <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F%23post-%2Fsecurity-events%2Fv1%2Fsecurity-events\" target=\"_blank\" rel=\"nofollow noopener ugc\">documentation on Security Events<\/a>, we have the following:<\/li>\n<\/ul>\n<div class=\"tableWrapper customized\" style=\"padding-left:0px\">\n<table>\n<colgroup>\n<col style=\"min-width:80px;width:300px\"><\/col>\n<col style=\"min-width:80px;width:300px\"><\/col>\n<col style=\"width:100%\"><\/col>\n<\/colgroup>\n<tr style=\"height:196.05325317383px\">\n<td>\n<p><strong>persistenceTimestampStart<br \/>&#13;<br \/>\ndate-time<\/strong><\/p>\n<\/td>\n<td>\n<p>Lower bound for persistence timestamp in the returned security events. Minimum allowed value is\u00a02022-08-01T00:00:01Z.<\/p>\n<p>The time range between <strong>persistenceTimestampStart<\/strong> and <strong>persistenceTimestampEnd<\/strong> must be no longer than 30 days.<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p><strong>persistenceTimestampEnd<br \/>\ndate-time<\/strong><\/p>\n<\/td>\n<td>\n<p>Upper exclusive bound for persistence timestamp in the returned security events.<\/p>\n<p>The time range between\u00a0<strong>persistenceTimestampStart<\/strong><\/p>\n<p>and\u00a0<strong>persistenceTimestampEnd<\/strong>\u00a0must be no longer than 30 days.<\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<h2 data-id=\"recommendations\"><strong>Recommendations<\/strong><\/h2>\n<ul>\n<li>Only collect the full range of events once and store them for future use<\/li>\n<li>Only request a maximum of 30 days of events per request\n<ul>\n<li>If you need to request 90 days of data, you can make 3 requests for 30 days each<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2 data-id=\"recommended-polling-pattern-for-integrations-siem-data-lakes-etc\"><strong>Recommended Polling Pattern for Integrations (SIEM, Data Lakes, etc.)<\/strong><\/h2>\n<p>For integrations that continuously ingest Security Events (e.g., SIEM pipelines), we strongly recommend using an <strong>incremental polling approach<\/strong>:<\/p>\n<ul>\n<li>Poll the Security Events endpoint at a regular interval (e.g., every 5\u201315 minutes).<\/li>\n<li>In each poll, request <strong>only new or updated events since your last successful request<\/strong> by using the <strong>persistenceTimestampStart<\/strong> parameter.<\/li>\n<li>Maintain a checkpoint (e.g., last seen <strong>persistenceTimestamp<\/strong>) in your system to ensure continuity between requests.<\/li>\n<\/ul>\n<p><strong>Example pattern:<\/strong><\/p>\n<p>Initial fetch:<\/p>\n<ul>\n<li>Retrieve a historical dataset once (e.g., last 30\u201390 days, split into 30-day windows).<\/li>\n<li>Store the latest <strong>persistenceTimestamp<\/strong> from the response.<\/li>\n<\/ul>\n<p>On subsequent polls:<\/p>\n<ul>\n<li>Use the stored timestamp as <strong>persistenceTimestampStart<\/strong><\/li>\n<li>Set <strong>persistenceTimestampEnd<\/strong> to the current time<\/li>\n<li>Retrieve only newly available events<\/li>\n<\/ul>\n<h2 data-id=\"future-changes\"><strong>Future Changes<\/strong><\/h2>\n<p>We will start enforcing the 30 day limitation per request starting from <strong>September 7th 2026<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We have observed that some of &hellip;<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-7364","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"f21abf5176a44c377ef5481e4994ed2447f7ae4d","vanilla_article_id":32942,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/32942-guidance-for-using-the-elements-api-and-the-security-events-endpoint","vanilla_category_id":142,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement\/7364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement\/7364\/revisions"}],"predecessor-version":[{"id":8873,"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement\/7364\/revisions\/8873"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/media?parent=7364"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement_category?post=7364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}