12.2 Configuring Time in Sentinel

The Correlation Engine processes time-ordered streams of events and detects patterns within events as well as temporal patterns in the stream. However, sometimes the device generating the event might not include the time in its log messages. To configure time to work correctly with Sentinel, you have two options:

To change this setting on the event source:

  1. Log in to Event Source Management.

    For more information, see Accessing Event Source Management in the NetIQ Sentinel 7.0.1 Administration Guide.

  2. Right-click the event source you want to change the time setting for, then select Edit.

  3. Select or deselect the Trust Event Source option on the bottom of the General tab.

  4. Click OK to save the change.