diff --git a/config/ocsentinel-settings.example.json b/config/ocsentinel-settings.example.json
index c22ba2e..22d2718 100644
--- a/config/ocsentinel-settings.example.json
+++ b/config/ocsentinel-settings.example.json
@@ -1,5 +1,6 @@
 {
   "warningEventThreshold": 10,
+  "maxReportedEvents": 1000,
   "criticalEventThreshold": 30,
   "warningUniqueIpThreshold": 5,
   "criticalUniqueIpThreshold": 12,
diff --git a/src/OCSentinelCli/AttackScanner.cs b/src/OCSentinelCli/AttackScanner.cs
index 06256bc..48d6044 100644
--- a/src/OCSentinelCli/AttackScanner.cs
+++ b/src/OCSentinelCli/AttackScanner.cs
@@ -53,6 +53,14 @@ internal sealed class AttackScanner
 
         attacks.Sort(static (left, right) => left.Timestamp.CompareTo(right.Timestamp));
 
+        int totalEventCount = attacks.Count;
+        int maxReportedEvents = Math.Clamp(configuration.MaxReportedEvents, 100, 5000);
+        List<AttackEvent> reportedEvents = attacks
+            .OrderByDescending(static attack => attack.Timestamp)
+            .Take(maxReportedEvents)
+            .OrderBy(static attack => attack.Timestamp)
+            .ToList();
+
         List<AggregatedAttack> topSources = attacks
             .GroupBy(static attack => attack.SourceIp)
             .Select(group => AggregatedAttack.FromGroup(group))
@@ -81,7 +89,9 @@ internal sealed class AttackScanner
             GeneratedAtUtc = generatedAtUtc,
             ClientVersion = BuildMetadata.Version,
             LookbackDays = options.LookbackDays,
-            TotalEvents = attacks.Count,
+            TotalEvents = totalEventCount,
+            ReportedEventCount = reportedEvents.Count,
+            EventsTruncated = reportedEvents.Count < totalEventCount,
             UniqueIpCount = uniqueIpCount,
             AlertState = correlationAssessment.FinalAlertState,
             AlertReason = correlationAssessment.CorrelationReason == "No CVE correlation applied." ? baseAlertReason : correlationAssessment.CorrelationReason,
@@ -95,7 +105,7 @@ internal sealed class AttackScanner
                 FinishedAtUtc = generatedAtUtc,
                 UploadAttempted = false
             },
-            Events = attacks,
+            Events = reportedEvents,
             TopSources = topSources,
             Errors = errors
         };
diff --git a/src/OCSentinelCli/Configuration.cs b/src/OCSentinelCli/Configuration.cs
index 68c43ce..032b1bf 100644
--- a/src/OCSentinelCli/Configuration.cs
+++ b/src/OCSentinelCli/Configuration.cs
@@ -6,6 +6,8 @@ internal sealed record ScannerConfiguration
 {
     public int WarningEventThreshold { get; init; } = 10;
 
+    public int MaxReportedEvents { get; init; } = 1000;
+
     public int CriticalEventThreshold { get; init; } = 30;
 
     public int WarningUniqueIpThreshold { get; init; } = 5;
diff --git a/src/OCSentinelCli/Models.cs b/src/OCSentinelCli/Models.cs
index 5b4220f..903442a 100644
--- a/src/OCSentinelCli/Models.cs
+++ b/src/OCSentinelCli/Models.cs
@@ -107,6 +107,10 @@ internal sealed record ScanResult
 
     public int TotalEvents { get; init; }
 
+    public int ReportedEventCount { get; init; }
+
+    public bool EventsTruncated { get; init; }
+
     public int UniqueIpCount { get; init; }
 
     public string AlertState { get; init; } = "ok";
diff --git a/src/OCSentinelCli/OCSentinelCli.csproj b/src/OCSentinelCli/OCSentinelCli.csproj
index 27cc7a3..0c76748 100644
--- a/src/OCSentinelCli/OCSentinelCli.csproj
+++ b/src/OCSentinelCli/OCSentinelCli.csproj
@@ -9,10 +9,10 @@
     <RootNamespace>OCSentinelCli</RootNamespace>
     <Product>OfficeCom Sentinel</Product>
     <Company>OfficeCom</Company>
-    <Version>1.5.0-beta.6</Version>
+    <Version>1.5.0-beta.7</Version>
     <AssemblyVersion>1.5.0.0</AssemblyVersion>
     <FileVersion>1.5.0.0</FileVersion>
-    <InformationalVersion>1.5.0-beta.6</InformationalVersion>
+    <InformationalVersion>1.5.0-beta.7</InformationalVersion>
   </PropertyGroup>
 
   <ItemGroup>