AnsweredAssumed Answered

Windows Audit Event - TZ changed

Question asked by Alain Silva on Dec 18, 2020

The ESA Rule Failed Logins Outside Business Hours change the event time to UTC +3:00. The correct event time is 09:38:41. Why Raw Log is 12:38:41?

 

 

RAW Log

Fri Dec 18 12:38:41 2020

 

Event Time
12/18/2020 09:38:41

 

Collection Time

12/18/2020 09:40:01

 

Time Zone of the Netwitness hosts and Windows Domain controller is GMT -3

 

Attachments

Outcomes