Forum Discussion

lfk73's avatar
lfk73
Brass Contributor
Sep 17, 2019

Log timestamp accuracy

While recently trying to trace events I notice that the date and time stamp in the audit log search results and in the Investigation results only show timestamps at HH:MM:SS.  No milliseconds and I'm...
Cloud App Security
Sebastien Molendijk's avatar
Sebastien Molendijk
Icon for Microsoft rankMicrosoft
Sep 23, 2019

lfk73 thanks for your question.

Can you please give me some examples of activities you see without the milliseconds ?

The data should be available in raw events and used by MCAS to order them.

 

Thanks

lfk73's avatar
lfk73
Brass Contributor
Sep 24, 2019

Sebastien Molendijk

 

For the sake of security I've omitted some details from the Raw Log but the key item is the Time stamp.

 

This is an example of a failed logon.  You see the time stamp goes down to milliseconds (23:50:12.0098591)

 

"ApplicationName": "Office 365 Exchange Online",
"SasStatus": null,
"TimeStamp": "2019-09-23T23:50:12.0098591Z",
"HomeTenantUserObjectId": "XXX",
"MfaRequired": true,

 

However another event that comes after this does not have millisecond accuracy (23:52:20.0000000)

 

"OrganizationName": "XXX",
"OrganizationId": "XXX",
"ExternalAccess": false,
"CreationTime": "2019-09-23T23:52:20.0000000Z",
"Workload": "Exchange",
"RecordType": 2,

 

As a result I have found when there are a large enough number of events occurring at the same time down to the second they sometimes appear out of order based on the order I know they occurred in.

Resources