Who rated this post

Hello @sushant1601 

Thanks for reaching out on LiveCommunity!

Please find below answers to your queries.

1. local_insert_ts field contains the date and time when XDR agent ingests an alert into cortex XDR tenant. In other words, it is the date and time when Cortex XDR’s Investigation and response became aware about an alert.                            Creation_time field represents the date and time when an alert was created on the endpoint.
2. For the log to be available to fetch , it will be created with insertion time, that is when the log is ingested.
3. No, each log has its local_insert_ts, once the value is created it wont be changed , when  a new log is ingested into XDR then a new local_insert_ts will be present in the log for that specific event