Forum Discussion
Timestamps in AlertTable
Timestamps behave differently depending on the relevant alert provider and specific alert.
For alerts that aren’t Sentinel scheduled alerts the alert provider determines the start time, end time and processing time of the alert.
For scheduled alerts it depends whether the query results contain the TimeGenerated of the events or not – if it does then the start and end times of the alert will be determined based on the earliest and last events, if it doesn’t they will be based on the time period that was queried to create the alert. TimeGeneraged and ProcessingEndTime are identical and refer to the time in which the query ran and the alert was created.
Microsoft
Timestamps behave differently depending on the relevant alert provider and specific alert.
For alerts that aren’t Sentinel scheduled alerts the alert provider determines the start time, end time and processing time of the alert.
For scheduled alerts it depends whether the query results contain the TimeGenerated of the events or not – if it does then the start and end times of the alert will be determined based on the earliest and last events, if it doesn’t they will be based on the time period that was queried to create the alert. TimeGeneraged and ProcessingEndTime are identical and refer to the time in which the query ran and the alert was created.