You can analyze the difference between trace time and detection time of an activity due to lag in the network.
Trace time is the time at which an event is traced on the endpoint. Detection time is the time at which Trellix EDR records the traced event.
Note
Always consider Detection Time for searching the historical data of endpoints.
Here is an example showing difference in Trace Time and Detection Time considering different scenarios.
Time and Activity | Scenario 1 (Out of sync with the current time) | Scenario 2 (In sync with the current time) |
|---|---|---|
Current standard time | 12 a.m. | 12 a.m. |
Time shown on the endpoint | 1 a.m. | 12 a.m. |
Trace time detected on the endpoint | 1 a.m. | 12 a.m. |
Trace time recorded on Trellix EDR | 12.01 a.m. | 12.01 a.m. |
The result shown on the Historical Search dashboard | Trace Time — 1 a.m. Detection Time — 12.01 a.m. | Trace Time — 12 a.m. Detection Time — 12.01 a.m. |