I am running into an issue where the timestamp coming from Cisco Firepower module is not treated as UTC.
The following message:
<117>Mar 27 00:59:55 FW-SFR SFIMS: Protocol: TCP, ... Error, Sinkhole: Unknown, SecIntMatchingIP: Destination, IPReputationSICategory: Attackers, URLCategory: Unknown, URLReputation: Risk unknown
Has Graylog timestamp of:
My time configuration is set to Central:
It looks like Graylog is treating the time on the incoming message as Central and then converting to UTC.
Another Cisco device we have on a different input Graylog is assuming the time is UTC and is displaying properly.
Any help is appreciated.