hi all,
hope you’re having a good day.
We are facing an issue with one of our clients.
Namely, investigation timeline time is off by 2 hours.
We made sure that timezone in rapid7 is set correctly and regional setting (region, time, date) on local computer are set correctly as well (identical setting for other user is working as expected).
We even went so far as to delete and recreate the account in question, but the problem still persists.
The issue is present on single account, multiple other account are working as expected (different timezones but no issues)
Kindly advise what more can be done.
Hello! Just to confirm, is your profile set to Browser-Local for displaying the time zone?
In IDR: Settings → User Preferences
1 Like
hi Hannah,
Thank you for your response.
Present settings as follows:
Just to verify, the timestamp you have highlighted is essentially 2 hours behind what you expect the timestamp to be for your timezone correct?
For example if you were in EDT and the actual event occurred at 9PM but the server was in MDT so it’s log time says 7PM. But for some reason the UI shows it as 11PM?
Another question, did the alert get triggered at the right time and just show the wrong time or did the alert literally fire 2 hours after the event occurred?
hi John,
correct, alert is fine, no issues with the alert.
The only issue is that time of alert creation is incorrectly displayed for a single user.
Identical settings for different user are fine, showing correct alert time.
Given that the issue is only for a certain user I would assume it has to be something with that users timezone somewhere. If that users settings are also set to browser local and they are indeed in a timezone where the alert is showing two hours ahead then I think the best thing to do would be reach out to support. They may ask you to grab a .har file to understand what’s going on with that users browser.
For self troubleshooting as well, does it appear the same way for that user when logging in through a different browser, e.g. Firefox vs chrome or something?
Great idea John.
We will test another account on client’s pc to determine if the issue is PC or Account.
and also another browsers.
