Skip to main content

Convert the output of a JSON which is a LDAP timestamp

  • February 19, 2023
  • 5 replies
  • 6 views

Forum|alt.badge.img+1

Hi, does anybody know how to convert the output of a JSON which is a LDAP timestamp (18-digit Active Directory timestamps) into human readable format YYYY/MM/DD by any action or function available in Chronicle SOAR?

5 replies

mccrilb
Forum|alt.badge.img+12
  • Silver 2
  • March 13, 2023

in the Functions there is a Convert Time Format


Forum|alt.badge.img+1
  • Author
  • New Member
  • March 13, 2023

That was my first thought but you have to enter a "From Format" out of https://strftime.org/ and there is no suitable one for this 18 digit timestamp.


mccrilb
Forum|alt.badge.img+12
  • Silver 2
  • March 13, 2023

sorry. I was out on PTO. and woof... you might have to code your own then.


mccrilb
Forum|alt.badge.img+12
  • Silver 2
  • March 13, 2023

If you don't have functions installed, Market Place / Power ups


mccrilb
Forum|alt.badge.img+12
  • Silver 2
  • March 13, 2023

I have been working with the new UDM Querry Function for Chronicle. It doesn't look like the NOCASE statement works.