Wrong time at Security Events > Dashboard > Security Alerts

[Lucio Emanuel Soldo]

Hi everyone,

I have the following problem:

1) At Security Events > Dashboard > Security Alerts the time is the following:

My current time zone is UTC+1. The time showing by the picture is one hour earlier. It should had been 9.20.39.

My browser has the correct timezone and Kibana has browser as a time setting. No problem about it. 

Agent don´t have problem about timezone. I mean, the agent that is reporting that event is installed on a server where the timezone is correct UTC+1. No problem about it.

2) When I looking for that event at  Security Events > Events, I founded that event with correct Time field, but if I see inside the event I could see the data.win.system.systemTime has one hour earlier time that field Time has. 

Could you help me?

Thank in advance.

[mayte...@wazuh.com]

Hello Lucio,

 

If your issue is related to Eventime problem - Security Event, it will be fixed on v4.0.4-7.10.0 and v4.0.4-7.10.2 (4016 revision). You can check the performed changes in the following PR: Features/fix error timestamp security events.

 

These releases will be GA by the end of this month/beginning of the next one.

The data.win.system.systemTime field is not related to the Security Event time problem. This field refers to when the event was generated in the endpoint.

 

Best regards,

Mayte Ariza