topic Re: Correlation event shows wrong time in Network Security

Correlation event shows wrong time

ccna_security — Fri, 21 Feb 2020 17:13:43 GMT

Dear all. I configured correlation policy and started to collect logs. Moreover i configured that when correlation event happen firepower must send it via email. Actually everything worked correctly. Except one thing that related to timing. I got correlation event via email it shown that correlation had happened at 06.32 am but when i entered FMC and observed that correlation actually happened at 10.32 am . I am sure that FMC shows correct time because i tested it. i created correlation event on purpose and FMC shown correct time. But email didnt. Hope you understood what kind of issue i have faced. Please if possible help me to solve this problem. thanks in advance.

Re: Correlation event shows wrong time

Raed Boshmaf — Tue, 18 Jun 2019 07:49:52 GMT

Hi Ccns90

Email alert utilizes the system time which is configured to UTC and cannot be changed.

Based on what you mentioned I am assuming that your time zone is UTC+4 correct? (since the time difference is 4hours between what you see in the FMC event viewer; that is showing you the logs per the configured timezone and the timestamp you saw in the email alert) which should explain what you are seeing, the timestamp with email alerts is based on UTC (system time) and per my knowledge this can't be changed like Intrusion alerts for example (if you checked the Intrusion email tab under Alerts you will see that there is an option for timestamp, but for other alert that option doesn't exist).

Hope this gives you some clearance.

Regards

Raed

Re: Correlation event shows wrong time

ccna_security — Tue, 18 Jun 2019 08:37:14 GMT

Thank you Raed Boshmaf. Your explanation is so clear

Is there other way to configure correlation send me email with correct timestamp?

Re: Correlation event shows wrong time

Raed Boshmaf — Tue, 18 Jun 2019 10:28:49 GMT

Per my knowldge there isn't a way at the moment.

Regards
Raed