Best Time Field to Query Security Incidents

[tipper1510]

Hi,

What is the best time field to use for querying Security Incidents? I have seen examples using both TimeGenerated and CreatedTime. They produce quite different results.

Many thanks,

Tim

[#2]

Generally the answer is TimeGenerated https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-standard-columns#timegenerated

CreatedTime is a Sentinel column, and typically appears after TimeGenerated in a Query (as the Log record is subject to latency and processing, and only some activities create an Incident ) .
See these examples:https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-standard-columns#timegenerated

Also https://learn.microsoft.com/en-us/rest/api/securityinsights/stable/incidents/get?tabs=HTTP#incident