Correlation event shows wrong time

[ccna_security]

Dear all. I configured correlation policy and started to collect logs. Moreover i configured that when correlation event happen firepower must send it via email. Actually everything worked correctly. Except one thing that related to  timing. I got correlation event via email it shown that correlation had happened at 06.32 am but when i entered FMC and observed that correlation actually happened at  10.32 am . I am sure that FMC shows correct time because i tested it. i created correlation event on purpose and FMC shown correct time. But email didnt. Hope you understood what kind of issue i have faced. Please if possible help me to solve this problem. thanks in advance.

[Raed Boshmaf]

Hi Ccns90

Email alert utilizes the system time which is configured to UTC and cannot be changed.

Based on what you mentioned I am assuming that your time zone is UTC+4 correct? (since the time difference is 4hours between what you see in the FMC event viewer; that is showing you the logs per the configured timezone and the timestamp you saw in the email alert) which should explain what you are seeing, the timestamp with email alerts is based on UTC (system time) and per my knowledge this can't be changed like Intrusion alerts for example (if you checked the Intrusion email tab under Alerts you will see that there is an option for timestamp, but for other alert that option doesn't exist).

Hope this gives you some clearance.

Regards

Raed

[ccna_security]

Thank you Raed Boshmaf. Your explanation is so clear

Is there other way to configure correlation send me email with correct timestamp?

[Raed Boshmaf]

Per my knowldge there isn't a way at the moment.

Regards
Raed