The event time is not the rule date

Event time comes from the log

The event time on an alert is the timestamp the grouped log used for the activity. It is when that record says the activity happened, in the zone the field uses. It is not the day someone wrote the rule.

If several events were grouped, say whether you are quoting the earliest, the latest, or a single event you opened. Do not pick the rule date to stand in for any of them.

The rule date is about the rule

The date in the rule file, or the created field on the rule, is when that rule text was written or stored. A rule from August can alert on a November event. August is not when the activity happened.

Editing the rule later can add another date. Label the one you read. Do not treat a rule date as the first time the behavior was possible.

The opened time is a third clock

The time the alert was opened in the queue is when the detection created the queue item. It can be minutes after the event time. If that field was not saved, write that the opened time is not in the note. Do not copy the event time into it without the label.

Lab: August on the rule and November on the event

A lab alert shows event time 2026-11-03T09:14:00Z. The rule file for HB-DET-014 is dated 2026-08-01. The opened time was not copied. A draft says the activity started on 1 Aug because that is the rule date.

The note keeps 3 Nov 09:14Z as the event time and 1 Aug as the rule date. Opened time: not saved. The activity is not moved to August.

rule id: HB-DET-014
event time: 2026-11-03T09:14:00Z
rule date: 2026-08-01
opened time: not saved
write: event clock and rule clock
not: activity started in August