Convert the output of a JSON which is a LDAP timestamp

[JonasB]

Hi, does anybody know how to convert the output of a JSON which is a LDAP timestamp (18-digit Active Directory timestamps) into human readable format YYYY/MM/DD by any action or function available in Chronicle SOAR?

[mccrilb]

in the Functions there is a Convert Time Format

[JonasB]

That was my first thought but you have to enter a "From Format" out of https://strftime.org/ and there is no suitable one for this 18 digit timestamp.

[mccrilb]

sorry. I was out on PTO. and woof... you might have to code your own then.

[mccrilb]

If you don't have functions installed, Market Place / Power ups

[mccrilb]

I have been working with the new UDM Querry Function for Chronicle. It doesn't look like the NOCASE statement works.