Somebody know have I can change datatime format in reports? Now in Investigation tab I see eventtime (time) in format "yyyy-MM-dd HH:mm:ss". When I create report - datatime format changes to "yyyy-MMM-dd HH:mm:ss". It's very bad (I create case to support). In RSA enVision was be a lot of datatime format, for example "yyyy-MM-dd" or "yyyy-MM-dd HH", maybe somebody know have reproduce this in RSA Security Analytics?
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
According to my knowledge, there are two types of time.
1) The event time, on which the event is being generated
2) The collection time, where the event is being collected by RSA SA.
That is correct. The time you get in SA and what you query on is the time it was received. This can be slightly annoying when looking at logs from a VLC or Any other type that is not syslog. Unfortunately not all logs have a datetime in them, so they system needs to go by time of collection so everything is more unified.