Export CSV downloads the events of the current filter, at most 12 months: times in UTC, columns time_utc, actor, actor_type, action, action_label, object_type, object, result, source, ip, commit, request_id. The export itself is recorded in the audit log. The log is stored outside your nodes and cannot be altered by operators.