We have created two use cases and set up correlation search, Trigger time is every 10 minutes. When notable event generate in incident review tab, What we observer there is fluctuation in time, trigger time and notable event time are different. Please refer below screenshot for time difference highlighted. Trigger time: 1/6/21 4:06:45.000 AM Audit User Account x was Locked out by Host Adaptive Responses: Response Mode Time User Status Notable saved 2021-01-05T17:12:35+1100 success Need to understand why there is time difference? Thanks, Sahil
... View more