Activity Time - Cortex XDR API

YilmazDincer — Tue, 17 Jan 2023 11:44:46 GMT

Hi all,
I get the data with Cortex XDR API. I couldn't find which field the Activity Time field matches. The closest results are event_timestamp and detection_timestamp, but not all of them are correct.

Re: Activity Time - Cortex XDR API

bbarmanroy — Thu, 19 Jan 2023 01:57:10 GMT

Hi @YilmazDincer I took a random incident from a tenant that I have access to.

As you can see, the timestamp for the alert was : Jan 18th 2023 19:47:57 local time (GMT+8)

When I retrieve the extra incident data using API's, I get the epoch timestamp as 1674042477207 for both fields.

Converting the epoch timestamp into human readable format, I get the same time as was shown in UI.

If an incident has multiple alerts, each of them will have their own timestamps. I hope this clarifies.

topic Re: Activity Time - Cortex XDR API in Cortex XDR Discussions

Activity Time - Cortex XDR API

Re: Activity Time - Cortex XDR API