We are observing an apparent timestamp inconsistency in logs ingested by Rapid7 from a FortiGate device. The date shown by Rapid7 is extremely old and does not match the actual event time.
The raw log contains an eventtime value of 1765994615758544799 with timezone +0100, which suggests the event should correspond to a much more recent date, yet Rapid7 displays it as December 17, 2025 at 19:03:36, which is inconsistent with our environment and current timeline.
This leads us to believe there may be an issue with how Rapid7 is parsing or converting the FortiGate eventtime field (nanoseconds / epoch precision) rather than an issue on the device itself, as the firewall clock and other logs appear correct.
Has anyone encountered similar behavior with FortiGate logs in Rapid7?
Any guidance on timestamp normalization or known parsing issues would be appreciated.
Thanks in advance.