Forum Discussion

Brass Contributor

Sep 17, 2019

Log timestamp accuracy

While recently trying to trace events I notice that the date and time stamp in the audit log search results and in the Investigation results only show timestamps at HH:MM:SS. No milliseconds and I'm...

Cloud App Security

Sebastien Molendijk

Microsoft

Sep 23, 2019

lfk73 thanks for your question.

Can you please give me some examples of activities you see without the milliseconds ?

The data should be available in raw events and used by MCAS to order them.

Thanks

lfk73
Brass Contributor
Sep 24, 2019
Sebastien Molendijk

For the sake of security I've omitted some details from the Raw Log but the key item is the Time stamp.

This is an example of a failed logon. You see the time stamp goes down to milliseconds (23:50:12.0098591)

"ApplicationName": "Office 365 Exchange Online",
"SasStatus": null,
"TimeStamp": "2019-09-23T23:50:12.0098591Z",
"HomeTenantUserObjectId": "XXX",
"MfaRequired": true,

However another event that comes after this does not have millisecond accuracy (23:52:20.0000000)

"OrganizationName": "XXX",
"OrganizationId": "XXX",
"ExternalAccess": false,
"CreationTime": "2019-09-23T23:52:20.0000000Z",
"Workload": "Exchange",
"RecordType": 2,

As a result I have found when there are a large enough number of events occurring at the same time down to the second they sometimes appear out of order based on the order I know they occurred in.