The Google Cloud Security Community will be in read-only mode July 16 - July 22 as we migrate platforms. Read more and check out our FAQ.

[Andrew_Cook]

Any thoughts on where I'm going wrong trying to subtract 30 minutes from this timestamp using Functions > Convert Time Format ? The input is 2021-09-10T19:00:06.951Z and the broken output is %Y-%32-%5T%18:%9:%9.%f+0000 . I'd like to return 2021-09-10T18:30:06.951Z . I suspect it has something to do with my time format being off ( %Y-%m-%dT%H:%M:%S.%fZ )

View files in slack

[Andrew_Cook]

Figured out my issues, it's a mistake in the Convert Time Format action. Both format fields tell you that you need to use Arrow format and not strptime, but they're mismatched. One is strptime and the other is Arrow. It's line 50 in the code that needs some fixing.

[Andrew_Cook]

Still no luck. Saw it needs to be in arrow format so I tried YYYY-MM-DD'T'HH:mm:ss.SSS'Z' but '2021-09-10T19:02:06.951Z' does not match format YYYY-MM-DD'T'HH:mm:ss.SSS'Z'

[Andrew_Cook]

Also tried YYYY-MM-DD[T]HH:mm:ss.SSSZ and YYYY-MM-DD[T]HH:mm:ss.SSSZ same result

[Andrew_Cook]

Just made my own Shift Time action and fixed the problem. Default format is YYYY-MM-DD[T]HH:mm:ss.SSS[Z] . I still don't know what I was doing wrong with Convert Time but this works well for now:
from SiemplifyAction import *
import arrow
from dateutil import tz
import pytz

def main():
siemplify = SiemplifyAction()
siemplify.script_name='Convert Time Format'
params = siemplify.parameters
input_str = params.get('Input')
use_format = params.get('Format')
days = params.get('Days', 0) or 0
hours = params.get('Hours', 0) or 0
minutes = params.get('Minutes', 0) or 0
seconds = params.get('Seconds', 0) or 0

time = arrow.get(input_str)
new_time = time.shift(days=int(days), hours=int(hours), minutes=int(minutes), seconds=int(seconds))

result_value = new_time.format(use_format)

output_message = result_value
siemplify.end(output_message, result_value)

if __name__ == "__main__":
main()

[Tomtomfridman]

Hi @Andrew Cook
Thank you for your input, we will update the documentation accordingly