Document:Cortex XDR™ XQL Language Reference

timestamp_seconds

Search the Table of Contents

Cortex XDR XQL timestamp_seconds() function returns accepts an int representing the number of seconds since the Unix epoch, and returns a timestamp.

timestamp_seconds (<integer>)

The

timestamp_seconds()

function interprets

int64_expression

as the integer value in seconds, as of 1970-01-01 00:00:00 UTC.

Display a human-readable timestamp for the

action_file_access_time

field.

alter access_timestamp = timestamp_seconds(1611882205) | limit 1