Timezones in Hunt/Alerts in UTC time rather than local

[greatapoc]

I'm in Australia/Sydney timezone and the Alerts/Hunt page appears to be only showing the UTC time in the Timestamp column. The Timeline graph at the top of the Hunt page appears to be showing the correct timezone. Is that the correct method? I'd just prefer to see the local time in the Timestamp column.

Secondary to that on both the Alerts and Hunt pages the time filter (ie Last x minutes/days/etc) doesn't filter straight away when you browse to the page for the first time. I have mine set to last 30 minutes and it is pulling the last 24 hours when I click Alerts/Hunt and then will filter down properly if I hit enter in the time filter box.

Just on a tangent to that is there any plan for a real-time Alerts view? A page we can just leave open and watch alerts as they come through would be great I think. The Hive was good for that previously but it seems like it has moved away from that purpose.

[greatapoc]

It seems like after updating to 2.3.1 the time filter on both Hunt and Alerts doesn't work with anything < 61 minutes. If I enter 61 minutes I have events, change it to 60 or less and there are 0.

[dougburks]

I just tested and last 24 minutes shows results for me.

[jertel]

The issue with navigating to Alerts or Hunt for the first time after logging into SOC, and it not using the correct time range will be corrected in the next release.

[jertel]

Also, the next release will show the event timestamps in local time. However, when an event is expanded, that expanded view will show the @timestamp, and any other date/time field as-is, which will likely continue to be UTC.

[greatapoc]

Thanks a lot @jertel that’s awesome.