Time difference between OS and SOC

[Anadema]

Version

xxx

Installation Method

xxx

Description

xxx

Installation Type

xxx

Location

xxx

Hardware Specs

xxx

CPU

10

RAM

xxx

Storage for /

xxx

Storage for /nsm

xxx

Network Traffic Collection

xxx

Network Traffic Speeds

xxx

Status

xxx

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I have a problem with an hour difference when I receive packets via tcpdump and when I see it appear in the SOC / Alert.

I've tried to set both to the same time but nothing changes, it looks like it's somewhere else.

To clarify, I receive the packet, I wait an hour and I see it in alert, but its timestamp corresponds perfectly to the time it arrived on the network cart.

Is it possible to align everything on the same NTP server? I'm looking at the documentation right now, but I must be missing the point...

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[Anadema]

OK solution must be on my browser not on the system certainly...

https://docs.securityonion.net/en/2.4/timezones.html

[Anadema]

Ok it was that, I put all for ETC/UTC and it take 5s to see the alert now, nice !