how to change timestamp in activity log from UTC?

[meshorer]

hello all,

I noticed that timestamp in activity log is in UTC, and also while using timer app and in the event name adding "$now()" ,the timestamp is also UTC.

it is not the time zone I defined in the user settings nor in the administration/company settings.

is there a way to change the time zone from UTC to different time?

[marnall · Accepted solution]

Unfortunately you'd have to change the python code to do this, at least for the timer app. If you open the timer_connector.py in $SOAR_HOME$/apps/timer_*/, then it formats the event name with this function:

    def _format_event_name(self):
        config = self.get_config()
        event_name = self._handle_py_ver_compat_for_input_str(config['event_name'])

        iso_now = datetime.datetime.now(pytz.utc).isoformat()
        label_name = config.get('ingest', {}).get('container_label', '')

        event_name = re.sub(
            r'(^|[^0-9a-zA-Z]+)(\$now)($|[^0-9a-zA-Z]+)',
            r'\g<1>{}\g<3>'.format(iso_now),
            event_name
        )

the time for the $now token is obtained from datetime.datetime.now(pytz.utc).isoformat() , explicitly setting the timezone to UTC.

I have not looked for the code writing the activity log but would assume it is the same.