Frequent Contributor.. Frequent Contributor..
Frequent Contributor..

Setting the end point time zone in events.

I would like to write some rules which take into consideration the time an event occurred in the users local time.   Unfortunately, the Final Device Time Zone is set based on the 'final device to handle an event before it is sent to a SmartConnector' and not the actual end point.

What is the best way to go about updating this field to contain the actual end point time zone?

Or should we be passing the end point time through in a custom field? And if we do this, will ArcSight translate this back into its default time zone anyway?

1 Reply
Acclaimed Contributor.
Acclaimed Contributor.

Both start time, end time and device receipt time is based on the time and timezone of the actual device, so it should normally just be written as a normal rule?

All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.