I have installed CEE on Windows.
Actually I wanted to get the event programmatically. For example some REST API to GET the events received by CEE or some file location where I can read it programmatically.
CEE is simply forwarding the events onto defined endpoints (Varonis, etc..), so you couldn't retrieve the messages from CEE, as they aren't stored on the CEE server.
You could setup syslog forwarding of the auditing events and grab the events from a syslog server.