how to change timestamp in activity log from UTC?

meshorer — Thu, 04 Apr 2024 17:09:03 GMT

hello all,

I noticed that timestamp in activity log is in UTC, and also while using timer app and in the event name adding "$now()" ,the timestamp is also UTC.

it is not the time zone I defined in the user settings nor in the administration/company settings.

is there a way to change the time zone from UTC to different time?

Re: how to change timestamp in activity log from UTC?

marnall — Tue, 09 Apr 2024 20:31:25 GMT

Unfortunately you'd have to change the python code to do this, at least for the timer app. If you open the timer_connector.py in $SOAR_HOME$/apps/timer_*/, then it formats the event name with this function:

def _format_event_name(self): config = self.get_config() event_name = self._handle_py_ver_compat_for_input_str(config['event_name']) iso_now = datetime.datetime.now(pytz.utc).isoformat() label_name = config.get('ingest', {}).get('container_label', '') event_name = re.sub( r'(^|[^0-9a-zA-Z]+)(\$now)($|[^0-9a-zA-Z]+)', r'\g<1>{}\g<3>'.format(iso_now), event_name )

the time for the $now token is obtained from datetime.datetime.now(pytz.utc).isoformat() , explicitly setting the timezone to UTC.

I have not looked for the code writing the activity log but would assume it is the same.

topic how to change timestamp in activity log from UTC? in Splunk SOAR

how to change timestamp in activity log from UTC?

Re: how to change timestamp in activity log from UTC?