Skip to content

v0.12.1

v0.12.1: fix(ingest): store parsed UTC detected_at, not the raw offset string
@pringgojs pringgojs tagged this 23 Jul 04:13 
The agent sends detected_at as RFC3339 with a +07:00 offset. The incidents
endpoint parsed it into a Carbon ($detectedAt) but then wrote the raw string
to the datetime column, so the wall-clock 20:57 was stored verbatim while
Laravel set created_at in UTC (13:57) — a 7-hour skew on 93% of incidents.

On the IP timeline this made a blocked IP look like it kept attacking hours
after the block: same event, shown once in UTC (created_at) and once in local
time (detected_at). Use the already-parsed $detectedAt, which is UTC.

The scan-findings endpoint was already correct (unix timestamp via
createFromTimestamp).
Assets 2
Loading