"Alarm Center" protocol

On the DHI-NVR4108-4KS2 model (firmware V4.001.0000005.2, Build Date: 19/07/2022), it is possible to configure, via Network > Alarm Center, the IP address of a remote server intended to receive alarm events generated by the NVR, using a protocol referred to as “Alarm Center.”

I am currently developing, for personal research purposes, a server application designed to receive and parse these events.

I have observed that the NVR periodically sends a keepAlive message every 10 seconds, which appears to be formatted in JSON.

However, when an actual alarm event is triggered, the payload received is not JSON-formatted. Interestingly, on at least one occasion, I did receive a JSON-formatted alarm message, but this no longer seems to be the case, which suggests either a configuration-dependent behavior or a protocol variation.

I would therefore like to understand the exact structure and semantics of the alarm event payloads sent by the NVR.

Is there any official documentation or protocol specification available that precisely describes the Alarm Center protocol, including message formats, field definitions, and transport details?