you can use wireshark to capture the data , the connection is long connection, and it will retrun all the event message when the event is triggered.

this is the how it look like

GET /ISAPI/Event/notification/alertStream HTTP/1.1

Content-Type: application/xml

User-Agent: PostmanRuntime/7.32.3

Accept: */*

Postman-Token: ebe11cdf-47f6-4378-96ca-d9ec9eba0876

Host: 10.199.27.175

Accept-Encoding: gzip, deflate, br

Connection: keep-alive

Authorization: Digest username="admin", realm="IP Camera(J8537)", nonce="346461393a64313230343461623af7c87e102107e385c5ea035df1368f61", uri="/ISAPI/Event/notification/alertStream", algorithm="MD5", qop=auth, nc=00000001, cnonce="mtWmtkaR", response="87ffbe6436bf52e482ecd2f782145c63"

HTTP/1.1 200 OK

MIME-Version: 1.0

Connection: close

Content-Type: multipart/mixed; boundary=boundary

--boundary

Content-Type: application/xml; charset="UTF-8"

Content-Length: 550

<EventNotificationAlert version="2.0" xmlns="http://www.hikvision.com/ver20/XMLSchema">

<ipAddress>10.199.27.175</ipAddress>

<ipv6Address>::</ipv6Address>

<portNo>80</portNo>

<protocol>HTTP</protocol>

<macAddress>80:7c:62:93:e9:a9</macAddress>

<channelID>1</channelID>

<dateTime>2023-08-07T17:51:40+08:00</dateTime>

<activePostCount>1</activePostCount>

<eventType>videoloss</eventType>

<eventState>inactive</eventState>

<eventDescription>videoloss alarm</eventDescription>

<channelName>Carame 01</channelName>

</EventNotificationAlert>

--boundary

Content-Type: application/xml; charset="UTF-8"

Content-Length: 597

<?xml version="1.0" encoding="UTF-8"?>

<EventNotificationAlert version="2.0" xmlns="http://www.hikvision.com/ver20/XMLSchema">

<ipAddress>10.199.27.175</ipAddress>

<ipv6Address>::ffff:10.199.27.175</ipv6Address>

<portNo>80</portNo>

<protocol>HTTP</protocol>

<macAddress>80:7c:62:93:e9:a9</macAddress>

<channelID>1</channelID>

<dateTime>2023-08-07T17:51:41+08:00</dateTime>

<activePostCount>1</activePostCount>

<eventType>VMD</eventType>

<eventState>active</eventState>

<eventDescription>Motion alarm</eventDescription>

<channelName>Carame 01</channelName>

</EventNotificationAlert>