Time Discrepancy in Windows Logs Causing Delayed Alerts

[Prakash_576]

Hi everyone,

I'm experiencing a time discrepancy issue in my Windows event logs, where the Event Received Time and Device Time are different. This time mismatch is causing my alerts to be delayed.

Has anyone else encountered this issue with Windows logs? Any suggestions on how to fix the time sync problem and ensure timely alerts would be greatly appreciated!


@srajeswaran @jasonhong @jbernabe 

[FSM_FTNT]

Hi, some questions and things to check

Are the events from a FortiSIEM Agent or through WMI/OMI?
If an Agent, what version?

Has there been any connectivity issues, that may be an issue?

Is NTP and device times correct on the Windows server and the FortiSIEM Collect?

Are you using WEF and the Agent is collecting from a WEF server?

What is the Event Receive time showing?
Do you have a sample log that has been delayed?