Trigger time is Populate different in incident review tab

[sahiltcs1]

We have created two use cases and set up correlation search, Trigger time is every 10 minutes.

When notable event generate in incident review tab, What we observer there is fluctuation in time, trigger time and notable event time are different.

Please refer below screenshot for time difference highlighted.

Trigger time:

1/6/21 4:06:45.000 AM

Audit

User Account x was Locked out by Host   Adaptive Responses:  Response Mode Time User Status Notable saved 2021-01-05T17:12:35+1100    success Need to understand why there is time difference? Thanks, Sahil

[scelikok]

The only think I can suggest is there may be a wrong timestamped event on EventID=4725 or 4722. Since you are using "latest(_time) as _time" it will try to get the latest event sorted by _time. Please check if the correlation search that creates mismatched times has wrong timestamped data. You should be see this by running these searches and checking _time field.

[scelikok]

If you can share your correlation search maybe we can investigate better.

[sahiltcs1]

first one-

| tstats summariesonly=f allow_old_summaries=t count latest(_time) as _time from datamodel="Change"
where All_Changes.result_id=4725 by All_Changes.dest All_Changes.action All_Changes.result All_Changes.user All_Changes.Account_Management.src_user
| rename All_Changes.* as * , Account_Management.* as * | convert timeformat="%Y/%m/%d %T" ctime(_time) as _time

2nd one-

| tstats summariesonly=f allow_old_summaries=t count latest(_time) as _time from datamodel="Change"
where All_Changes.result_id=4722 by All_Changes.dest All_Changes.action All_Changes.result All_Changes.user All_Changes.Account_Management.src_user
| rename All_Changes.* as * , Account_Management.* as * | convert timeformat="%Y/%m/%d %T" ctime(_time) as _time

[scelikok]

Hi @sahiltcs1,

On your sample Trigger time and Notable times are shown in different time zones. I assume your question is this  ~6 minutes delay on notable event time.

Since you are running correlation search on every 10 minutes, I assume your time range is something like -10m@m . Incident Review tab shows the actual event time that caused that notable. But notable time is the time that your correlation search finalizes by finding a result.

That is why it is normal that this time can be 0 to 10m before the notable event creation time.  

If this reply helps you an upvote is appreciated.

[sahiltcs1]

I don't think so its time zone issue, because other use cases we set up same condition and and in that use case we can see same time  there is no delay, But for this use case we are facing this issues