Ability to filter the "API Event" logs, to retain only the ones associated to a security alert

Our GSOC (Global Security Operations Center) is now monitoring Salesforce logs. 

For some logs the volume is huge, so we add filters in our SIEM's collect server to filter on the "PolicyID" of Event Monitoring / Transaction Security Policies. 

However for the "API Event" big object the PolicyID is always empty leaving us no possibility to filter on that. 

Anyone has already encountered the same issue? how did you proceed? would there be a way to filter this directly from the Salesforce API?  

Thank you very much beforehand.