Exact Time Frame of Dashboard and Reports in SOAR

[thida]

Is there any exactly Explanations or documentations about 'last 24hours','last month', 'Last Year' in SOAR Chronicle Dashboards & Reports time frame filter.

I understand as the following and am I right?
last 24hours :
Start Time: Subtract 24 hours from the current time.
End Time: Use the current time.

For example:
Last 24 Hours:
Start Time: April 24, 2024, 15:30 (Last 24 Hours)
End Time: April 25, 2024, 15:30 (if current time is)

Last 7 Days:
Start Time: April 18, 2024, 15:30 (Last 7 Days)
End Time: April 25, 2024, 15:30 (if current time is)

[f3rz · Accepted solution]

Hi @thida you right, all time filters in the dashboard equal a certain number of days:

Last 24 hours = 1
Last 72 hours = 3
Last Week = 7
Last 2 Weeks = 14
Last Month = 30
Last 3 Months = 90
Last 6 Months = 180
Last Year = 365

For example, if you search for the last 7 days:
1. Platform finds current time in UTC timezone, let's say: 04/29/2024 01:00:00 UTC
2. From the current time, it subtracts the number of days.
In our example with 7 days, it will be: 04/22/2024 01:00:00 UTC
3. It gets all items (cases/alerts/playbooks/entities) that were created after 04/22/2024 01:00:00 UTC

[thida]

Thanks @f3rz 

I will mark as a solution for that.