How to use the transformation function FROM_CUSTOM_DATETIME in the mapping configuration?

[Michael_Schepp]

Is anybody able to give me more details on how to use the transformation function FROM_CUSTOM_DATETIME in the mapping configuration?
I'm having a timestamp like the following in my event: 2023-02-22T02:05:40.000Z
How do I transform it now, so that it will be succesfully mapped? Which parameters do I have to specify?

The documentation ( https://chronicle-soar.elevio.help/en/articles/459-configure-mapping-and-assign-visual-families ) doesn't help with that.

[shakedtal]

Hi @Michael_Schepp , This should be the correct format:
%Y-%m-%dT%H:%M:%S.%fZ

View files in slack

[shakedtal]

View files in slack

[shakedtal]

and this is the reference to all of the tokens that can be used: https://strftime.org/
Both start and end time must be mapped.
I hope this helps :)