Endpoint Protection Manager Risk Logs: Event Time Explained
search cancel

Endpoint Protection Manager Risk Logs: Event Time Explained

book

Article ID: 155281

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

What is the meaning / difference of the Timestamps in the Symantec Endpoint Protection Manager (SEPM) Risk Logs?

Resolution

Events Described:

Event Date  = ALERTDATETIME - The time of event occurrences.
Event Insert Time = ALERTINSERTTIME - The time at which the event was inserted in to the database.
Event End Date  = ALERTENDDATETIME - The time at which the event ended. This is the end of the aggregated event time.
Timestamp  = TIME_STAMP  - The time when this database record was entered or modified in the database, in milliseconds since 1970.

 

 

 

Additional Information

What conditions could be responsible to modify the records in database at a later date i.e past the Event Insert Date/Event End Date? 

SEPM inserts/updates these records into database based on opstate received from SEP client. As an example a virus found and current action taken on virus is quarantined/log only, same would be inserted into alerts table. At a later point in time the user updated the action as delete. This would be updated into db with updated timestamp.

“Timestamp” and “Event Insert Date” are same if there were NO modifications made to an Event at later date/time?

Yes, As per SEPM db schema:
ALERTINSERTTIME: The time that the event was inserted into the database.
TIME_STAMP: The time on the server when the event is logged into the system or updated in the system (GMT).