How do I pull a detailed report of all blocked exploits for our quarterly audit?

Hey folks! I've been diving deep into our Kubernetes security posture lately, and as part of our shift-left strategy, we've got Sophos Intercept X (with the container security module) running across our production clusters. It's been doing a fantastic job silently blocking stuff at runtime, which is great... until audit time rolls around! 😅

For our quarterly security reviews, the compliance team is asking for a **detailed, historical report of all blocked exploits, attempted malicious activities, and runtime protection events** from the last quarter. They don't just want a count; they want specifics: timestamp, workload/pod name, namespace, the exploit/malware name, the action taken (blocked), and ideally the associated container image SHA.

I've poked around the Sophos Central dashboard, and while I can see real-time events and some historical data, I'm struggling to find a way to:
* Pull a consolidated report for a custom date range (e.g., last 90 days).
* Filter *specifically* on blocked events (not just all detections).
* Export this data in a format (like CSV or JSON) that I can then integrate with our internal audit tooling.

Has anyone here built a pipeline for this? My initial thought was to check if there's a direct API from Sophos Central that I could query. I tried looking for something like a `GET /runtime/v1/events` endpoint but came up short. Alternatively, is there a way to configure Intercept X to forward all these security events to a SIEM or log aggregation system (like a Loki or Elastic Stack) where I could then write queries? I'd love to set up a GitOps-friendly process where this report generation is automated via a Kubernetes CronJob.

If API is the way, a snippet of a potential `curl` command or a Python script outline would be incredibly helpful. For example, something that structures the query:

```bash
# Pseudo-code for what I'm imagining
curl -X GET
-H "Authorization: Bearer $API_KEY"
"https://api.central.sophos.com/gateway/events/v1/events?type=interceptx.container.runtime.block&from=2024-01-01&to=2024-03-31"
```

Or, if the solution involves the Intercept X for Containers Helm chart, is there a `values.yaml` configuration to increase event verbosity or set up a syslog forwarder? My current core configuration for the chart is pretty standard:

```yaml
# values.yaml snippet
cloud:
enabled: true
provider: "azure" # our environment
clusterSecurity:
runtimeProtection:
enabled: true
admissionControl:
enabled: true
```

Any insights, YAML snippets, or war stories from your own audit journeys would be massively appreciated. How are you all handling the compliance reporting piece with Sophos in a Kubernetes-native way?