Share via

Sentinel KQL converting Epoch to normal DateTime

Sean 101 Reputation points
2020-11-20T11:30:26.54+00:00

Hello,

Is there an Azure Sentinel KQL that will allow me to take EPOCH time and display it as a normal DateTime such as 11/20/2020, 11:24:31.227 AM in a column as standard?

41420-image.png

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,065 questions
Accepted answer
  1. Sean 101 Reputation points
    2020-11-22T13:19:38.06+00:00

    I managed to figure it out, here is the KQL that I used in the end (had to convert to long):

    CommonSecurityLog
    | extend SourceTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime))

    41701-image.png

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest