Skip to main content
Question

Has anyone created custom timestamp for Azure Monitor in Sentinel?

  • March 11, 2025
  • 2 replies
  • 15 views
M

Hi All! When using the azure monitor destination has anyone been able to successfully set a custom timestamp field which gets translated to TimeGenerated within Sentinel? The azure monitor HTTP data collector api documentation indicates this can be set using the "time-generated-field" request header, but we're not having any luck with that so far.

    2 replies

    C
    • Chris Morris
    • Employee
    • March 11, 2025

    Example below on how it can be achieved using the `_time` field:

    M
    • Mo Hassan
    • Author
    • Employee
    • March 11, 2025

    Thanks, Chris. The issue we're running into is that TimeGenerated appears to be a reserved property within azure monitor so Sentinel is not using it when it's just a field in our events. Instead TimeGenerated within Sentinel is being set to ingest/received time

    Terms & ConditionsAccessibility statement