Hi Marcelo,
Thanks for using Cisco Community, regarding your inquiry, unfortunately, the events on the "Event Section" are deleted after 30 days.
On the AMP Console, you can find the event section in Analysis → Events
However, we have other logs that are saved for more than 30days, for example, the Audit Logs, you can find this information on Account → Audit Log
*************
If you want to review the events of a specific device you can find this information directly on the computer, there is a file called "History.db" inside the AMP Folder (Commonly storage in C → Program Files → Cisco → AMP)
If you open the file with a DB Browser
************
You can also create an Event Stream in order to send the events to a SIEM or a device to save all the events.
You can create this Event Stream by generating a Read/Write API (On the Console Navigate to Accounts → API Credentials), in the following link you can find the documentation of how to create the Event Stream https://api-docs.amp.cisco.com/api_resources/EventStream?api_host=api.amp.cisco.com&api_version=v1
I hope this information can be useful to you.
Have a great day!!!
