Setting the end point time zone in events.
I would like to write some rules which take into consideration the time an event occurred in the users local time. Unfortunately, the Final Device Time Zone is set based on the 'final device to handle an event before it is sent to a SmartConnector' and not the actual end point.
What is the best way to go about updating this field to contain the actual end point time zone?
Or should we be passing the end point time through in a custom field? And if we do this, will ArcSight translate this back into its default time zone anyway?
Both start time, end time and device receipt time is based on the time and timezone of the actual device, so it should normally just be written as a normal rule?
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.