Somebody know have I can change datatime format in reports? Now in Investigation tab I see eventtime (time) in format "yyyy-MM-dd HH:mm:ss". When I create report - datatime format changes to "yyyy-MMM-dd HH:mm:ss". It's very bad (I create case to support). In RSA enVision was be a lot of datatime format, for example "yyyy-MM-dd" or "yyyy-MM-dd HH", maybe somebody know have reproduce this in RSA Security Analytics?
I talk about this issue... First picture - Investigation Tab, second picture - Reports preview.
Hello,
According to my knowledge, there are two types of time.
1) The event time, on which the event is being generated
2) The collection time, where the event is being collected by RSA SA.
Thanks.
That is correct. The time you get in SA and what you query on is the time it was received. This can be slightly annoying when looking at logs from a VLC or Any other type that is not syslog. Unfortunately not all logs have a datetime in them, so they system needs to go by time of collection so everything is more unified.
Is it like this? This should be good enough right? The only issue with me now is the timezone in UTC.