Activity Time - Cortex XDR API

[YilmazDincer]

Hi all,
I get the data with Cortex XDR API. I couldn't find which field the Activity Time field matches. The closest results are event_timestamp and detection_timestamp, but not all of them are correct.

[bbarmanroy · Accepted solution]

Hi @YilmazDincer I took a random incident from a tenant that I have access to.

As you can see, the timestamp for the alert was : Jan 18th 2023 19:47:57 local time (GMT+8)

When I retrieve the extra incident data using API's, I get the epoch timestamp as 1674042477207 for both fields.

.

Converting the epoch timestamp into human readable format, I get the same time as was shown in UI.

If an incident has multiple alerts, each of them will have their own timestamps. I hope this clarifies.