Hi. most of the answers possible you have given yourself already. Logrun.pl will not allow you to change the log events time stamps. What you can do, is use historic hostnames when processing your historic event files, which will cause the events to show up mapped to special historic devices, e.g. palo-alto-events-jan25. To make sure no new offenses get generated by QRadar you can use a falsepos rule in order to prevent that from happening.