Nov 15 2019 10:35 AM
I noticed when looking at the Timeline while investigating an indecent that it was messed up. The date/times shown do not match what what I see in the Incident list and actually some of the dates are way before the Analytics rule was even created (like anything saying 8AM) Any ideas why this happened?
Nov 18 2019 01:38 PM - edited Nov 18 2019 01:40 PM
Nov 18 2019 01:38 PM - edited Nov 18 2019 01:40 PM
ill check with the team, this might be the incident created time vs the security alert creation time.
Nov 19 2019 09:15 AM
in the meantime, understand that asking for related alerts in investigation is querying SecurityAlert for that entity. Not all security alerts are incidents.
you dont have other security alerts in the workspace right? just the ones that are from the incidents shown?