Browse Live Discover and Response Queries by Category
Under Review

Sophos Central Live Discover "User account locked out" query missing timestamps

"User account locked out (Data Lake)" query in Live Discover is missing timestamps for the individual events in the report. How can we get the time stamps?

Knowing the event happened but not knowing when significantly hampers the investigation. 

Is there a way to pivot to the event details including time stamp? 

Sophos User2229
Parents
  • Thank you User930, but there is no additional time related field in this schema (per Sophos technical support). They advised me to go to Sophos community (here) to present the question as Sophos technical support doesn't provide support for the queries (Live Discover).
Comment
  • Thank you User930, but there is no additional time related field in this schema (per Sophos technical support). They advised me to go to Sophos community (here) to present the question as Sophos technical support doesn't provide support for the queries (Live Discover).
Children
No Data
Unfiltered HTML