IBM QRadar SOAR

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Dealing with date-time variables in Pre and Post-Processing scripts

  • 1.  Dealing with date-time variables in Pre and Post-Processing scripts

    Posted Wed October 17, 2018 12:09 PM
    The date-time format in Resilient is an epoch timestamp in milliseconds. This can get involved when converting between this and a readable date-time format in the Pre and Post-Processing scripts. 

    Epoch to readable date-time format:

    An example of this could be a function has inputs for a start and end date-time that it expects to be in the <g class="gr_ gr_20 gr-alert gr_gramm gr_inline_cards gr_run_anim Style multiReplace" id="20" data-gr-id="20">format </g>2018-07-18T16:32:42.238Z​<g class="gr_ gr_20 gr-alert gr_gramm gr_inline_cards gr_disable_anim_appear Style multiReplace" id="20" data-gr-id="20">,</g> the end user wants to call this function with a date period of the last 30 days. This can be achieved using the following code snippet:
    import java.util.Date as Date

# Set the custom range for the last 30 days
msDay = 60 * 60 * 24 * 1000
now = Date()
start_ts = Date(now.time - (30 * msDay))

start_datetime = str(start_ts.toInstant())
end_datetime = str(now.toInstant())​


    Readable date-time format to epoch:

    This can come in useful when a function returns a readable date-time string and the user wants to set that to a date-time field in Resilient. Since all date-time fields in Resilient require the date-time to be <g class="gr_ gr_13 gr-alert gr_spell gr_inline_cards gr_run_anim ContextualSpelling ins-del" id="13" data-gr-id="13">in</g> <g class="gr_ gr_15 gr-alert gr_gramm gr_inline_cards gr_run_anim Grammar only-ins doubleReplace replaceWithoutSep" id="15" data-gr-id="15">epoch</g>, the string must be converted. This can be done using the following code snippet:
    import java.util.Date as Date

incident.properties.date_time_field = Date("09/21/2018 18:16:37")


    ------------------------------
    Brian Walsh
    ------------------------------


Related Content