topic Re: Get results before and after 10 seconds of creation_time field in Cortex XDR Discussions

Get results before and after 10 seconds of creation_time field

rkumawat — Sun, 25 May 2025 23:55:30 GMT

I need a query which will give me results 10seconds before and 10seconds after the alert creation_time field for investigation from a hostname. So i need to add 10seconds to the alert creation_time field and subtract 10seconds from the creation_time field. Please also add the timezone of GMT +2

For example if the the alert creation time is May 19th 2025 18:30:50 then I should get results from May 19th 2025 18:30:40 to May 19th 2025 18:31:00

I tried multiple options but it is complex, challenging and very time consuming, Please help

Re: Get results before and after 10 seconds of creation_time field

aspatil — Tue, 27 May 2025 09:18:04 GMT

Hello @rkumawat ,

Do you want to investigate ALerts or incidents? There is nothing call alert creation time field, please refer to below:
_time: represents the timestamp of the actual event that triggered the alert.
event_timestamp:Also denotes the timestamp of the event related to the alert, typically mirroring the _time field.
Arrival_time: Indicates the time when the alert was ingested into the Cortex XDR system. (edited)

Please define your clear scope based on the above time fields.