---
title: Browse and download enrichment datasets
description: Explore enrichment records on the Operations Console RECORDS page, page through results with NEXT and PREV, export a CSV slice, and list datasets with argusctl records ls.
---

# Browse and download enrichment datasets



## Goal

Find the enrichment records for a tenant and time window, and pull them out as a dataset (for example a CSV for a tenant's quarter, or a slice to tag for fine-tuning).

## What the datasets are

Enrichment records are the rows the detection pipeline writes for each enriched event (the `argus.enrichment_records` table). The RECORDS page presents them as a tree by tenant, then store, then month; each leaf shows the record count, total bytes, and dataset coverage. Typical uses:

* Pull a CSV for a tenant's quarter.
* Tag a slice for fine-tuning or training data.
* Verify retention is moving cold data correctly.

## Prerequisites

* An operator PAT. Listing datasets needs only read access; CSV export uses the **`analytics:read`** scope.

## Steps (console)

1. Open the RECORDS page (route `#/records`) at ops.useargus.co.
2. Browse the tree: tenant, then store, then month. Each leaf shows count, bytes, and coverage, backed by `GET /enrichment/datasets` and `GET /enrichment/records` with tenant, store, and month filters.
3. Page through long result sets with the **NEXT** and **PREV** controls in the page footer. Results are cursor-paginated; the per-page limit caps at 500 rows, so anything past the first page is reached with NEXT.
4. Export a slice as CSV via the export action (backed by `POST /exports/csv`, scope `analytics:read`).

## Steps (CLI)

List the enrichment export datasets:

```bash
argusctl records ls
argusctl records ls --json     # machine-readable, stable field names
```

For a CSV export of a tenant window, the CLI equivalent of the console export is:

```bash
argusctl analytics export --tenant <id> --from 2026-04-01 --to 2026-04-30 --format csv
```

## Verify

* The exported CSV's row count should line up with the record count shown on the leaf you exported.
* `argusctl records ls --json` returns the same datasets the console tree shows.

## Troubleshooting

* **"More available" but you only see one page.** Use the NEXT control; the page size limit is 500 rows per request.
* **403 on export.** Your PAT lacks `analytics:read`. Mint a token that includes it (the `support-readonly` preset bundles the read scopes).
* **A transient 5xx on the page.** The console keeps the last good data on error and offers RETRY; the panel repaints in place once the API recovers.


---

For a semantic overview of all documentation, see [/sitemap.md](/sitemap.md)

For an index of all available documentation, see [/llms.txt](/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/agents.md](/agents.md)