timestamp_seconds

Cortex XDR XQL timestamp_seconds() function returns accepts an int representing the number of seconds since the Unix epoch, and returns a timestamp.

Synopsis

timestamp_seconds (<integer>)

The

timestamp_seconds()

function interprets

int64_expression

as the integer value in seconds, as of 1970-01-01 00:00:00 UTC.

Display a human-readable timestamp for the

action_file_access_time

field.

alter access_timestamp = timestamp_seconds(1611882205) | limit 1