The real-time events are compressed on the Agent-side with retention size of 2GB.
On the Agent-side it can be found under this path:
Stop the InTrust Agent Service on the computer.
Delete the 'tpvc' folder specified above.
Restart the Agent service when the root cause of the alerts has been corrected.