Documentation Center
AlienVault® USM Appliance™

Supported Formats by the normalize_date() Function

Applies to Product: USM Appliance™ AlienVault OSSIM®

When the USM Appliance plugins parse logs received from various devices, they use a built-in function, normalize_date(), to convert different date formats to ISO 8601, the format accepted by the USM Appliance Server.

The table below shows the date formats that the normalize_date() function supports. The normalize_date() function compares the date format in the log with the supported formats, in the order presented in this table, until it finds a match.

If the date format of your device is not listed in this table, you can write a custom function to parse it yourself. See Customize Plugin Date and Time Formats for instructions.

Date Formats supported by normalize_date()
Device or Format Name Example
DC

2/15/2012 12:00:36 PM

Syslog Oct 27 10:50:46
Apache 29/Jan/2007:17:02:20
Syslog-ng Oct 27 2007 10:50:46
Bind9 10-Aug-2009 07:53:44
Snare Sun Jan 28 15:15:32 2007
Snort 11/08-19:19:06
Suricata-http 03/20/2012-12:12:24.376349
Arpwatch Monday, March 15, 2004 15:39:19 +0000
Heartbeat 2006/10/19_11:40:05
Netgear 11/03/2004 19:45:46
Tarantella 2007/10/18 14:38:03
Citrix 02/28/2013:12:00:00
OSSEC 2007 Nov 17 06:26:18
IBM 11/03/07 19:22:22
Lucent1 084658,1516697218 (hhmmss,timestamp)
Lucent2 084658+/- (hhmmss+/-)
Lucent3 084658 (hhmmss)
Nagios rrd 1162540224
FileZilla 11.03.2009 19:45:46
HP Eva 2 18 2009 14 9 52
Websense2 11 Jan 2011 09:44:18 AM
Exchange 2011-07-08T14:13:42.237Z
Sonnicwall 2011-05-12 07 59 01
CSV 09/30/2011,10:56:11
Honeyd 2011-05-17-09:42:24
Epilog 2011-11-21 06: 15:02
WMI 20180121084344.000000-000
Spanish Date 20120202 12:12:12
SNMPTRAP Mar 07, 2012 - 08:39:49
CheckPoint 1Feb2012;0:05:58 or 1Feb2012 0:05:58
Lilian* Date 11270 02:00:16
Bluecoat 2015-08-14 09:30:00
American Date 08/14/15 09:30:00 or 08/14/2015 09:30:00
Fortigate date=2015-03-17 time=22:03:55
Sophos UTM 2014:09:06-00:00:06
Snare_2 Jan. 22 11:20 AM
Aruba-airwave 01/22/2018 11:20 AM
Anti-Spam SMTP Proxy (ASSP) 01-22-18 11:21:35

*Lilian is the number of days since the beginning of the Gregorian Calendar on October 15, 1582