How to convert epoch values to human redable format in OUTCOME section

[Mufa_shah]

Hi All,

I am trying to solve event first seen and last seen using  MIN, MAX  functions,  but it returns an epoch value.

How to convert this Epoch values ?

Also is this right way to calculate firstseen and last seen for events

Thanks in Advance

[bsalvatore · Accepted solution]

Hi,

I think you can use the new YARA-L functions like 

https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#timestampget_date

to convert unix seconds to a string with YYYY-MM-DD format.

[Mufa_shah]

thanks