We are troubleshooting some authentication issues in our environment, and using some simple Records queries to narrow down to the criteria we’re looking for. The Time field in these queries isn’t behaving the way we’d expect so I’m looking for some more info on how this field works.
The query in question is looking at LDAP Bind Requests for specific users. The Time field does not seem to correlate with the actual time that the user is performing this kind of activity (some results have a time when the user was not logged in).
Is the Time field supposed to be the start of a session, the end of a session, the average of the time that the session took place, the time that the session was recorded by ExtraHop, or something else entirely?
