Process Start Time - Client local time and TimeZone

Question

Question on the various times used in logging.

We are sending our on-prem UVM logs to a SIEM and they are seeing a field of “TimeCreated” which is Date / Time. To confirm, is this the time of the local client when this event was created? If so, can we have a timezone option with this? It would be very beneficial when incidents arise and we need to investigate that all of our times match up. If not, which date/time field should be lookedat? there are a several TimeCreate, FirstOccurence, LastOccurence

MikeK · Answer

Question on the various times used in logging.

We are sending our on-prem UVM logs to a SIEM and they are seeing a field of “TimeCreated” which is Date / Time. To confirm, is this the time of the local client when this event was created? If so, can we have a timezone option with this? It would be very beneficial when incidents arise and we need to investigate that all of our times match up. If not, which date/time field should be lookedat? there are a several TimeCreate, FirstOccurence, LastOccurence

Page 1 / 1

Question on the various times used in logging.

We are sending our on-prem UVM logs to a SIEM and they are seeing a field of “TimeCreated” which is Date / Time. To confirm, is this the time of the local client when this event was created? If so, can we have a timezone option with this? It would be very beneficial when incidents arise and we need to investigate that all of our times match up. If not, which date/time field should be lookedat? there are a several TimeCreate, FirstOccurence, LastOccurence

I believe these logs are captured and transmitted as UTC so that regardless of where the machines location is all of the logs enter into the console with same timestamp references. From the console you can set your own personal timezone so that the system does the required calculations to your timezone for easier understanding. SIEM info always transfers as UTC from what I have seen.

But to my knowledge there is no overall location to hard set a timezone for all logs.

Reply

Badge Earners

Reply

Badge Earners

Sign up

Login to the community

Scanning file for viruses.

This file cannot be downloaded