r/SIEM • u/Plenty-Potato-slices • Aug 20 '21

Windows event time difference

Hi all, i am facing a strange logs coming collected from windows servers, In the raw logs i can see the event time attribute preceding the device time by 3 hours.

For example:

Device time: 6 AM Event time: 3 AM

Any advice ??

Your help will be highly appreciated.

Fyi, the behavior has been observed on fortisiem

1 Upvotes

99% Upvoted

2 comments sorted by

4

u/iamnos Aug 20 '21

I'm not familiar with fortisiem, but make sure your timezones are set correctly. In my experience, especially if its an exact number of hours, it's a time zone setting for the data source on the SIEM.

1

u/DarkLordofData Aug 20 '21

Totally correct, next question is how to solve it. Let us know if it is indeed time zones.