AnalyzeTimestampIntervals
Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps.
python · Common Scripts
Details
| ID | AnalyzeTimestampIntervals |
|---|---|
| Language | python |
| From Version | 6.10.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
README
Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Cortex XSOAR Version | 6.10.0 |
Inputs
| Argument Name | Description |
|---|---|
| timestamps | List of Unix timestamps (in milliseconds) representing time intervals. |
| max_intervals_per_window | The maximum number of intervals allowed within a specific time window. |
| interval_consistency_threshold | The threshold for determining how consistent the intervals are (in seconds). |
| verbose | If true, includes detailed interval information in the output. |
Outputs
| Path | Description | Type |
|---|---|---|
| IntervalAnalysis.TimestampCount | The total number of timestamps analyzed. | number |
| IntervalAnalysis.MeanIntervalInSeconds | The average time interval (in seconds) between consecutive timestamps. | number |
| IntervalAnalysis.MedianIntervalInSeconds | The median time interval (in seconds) between consecutive timestamps. | number |
| IntervalAnalysis.StandardDeviationInSeconds | The standard deviation of the time intervals (in seconds) between consecutive timestamps. | number |
| IntervalAnalysis.HighFrequencyDetected | Indicates whether a high frequency of intervals within a short time window was detected. | boolean |
| IntervalAnalysis.ConsistentIntervalsDetected | Indicates whether the intervals between timestamps were consistent based on the standard deviation threshold. | boolean |
| IntervalAnalysis.IsPatternLikelyAutomated | Indicates whether the pattern of intervals is likely automated based on analysis. Intervals with high frequency or consistency can suggest the use of an automation. | boolean |
commonfields: id: AnalyzeTimestampIntervals version: -1 name: AnalyzeTimestampIntervals comment: Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps. script: '' type: python tags: [] enabled: true args: - name: timestamps required: true description: List of Unix timestamps (in milliseconds) representing time intervals. isArray: true - name: max_intervals_per_window description: The maximum number of intervals allowed within a specific time window. defaultValue: '60' - name: interval_consistency_threshold description: The threshold for determining how consistent the intervals are (in seconds). defaultValue: '0.1' - name: verbose description: If true, includes detailed interval information in the output. defaultValue: 'false' outputs: - contextPath: IntervalAnalysis.TimestampCount description: The total number of timestamps analyzed. type: number - contextPath: IntervalAnalysis.MeanIntervalInSeconds description: The average time interval (in seconds) between consecutive timestamps. type: number - contextPath: IntervalAnalysis.MedianIntervalInSeconds description: The median time interval (in seconds) between consecutive timestamps. type: number - contextPath: IntervalAnalysis.StandardDeviationInSeconds description: The standard deviation of the time intervals (in seconds) between consecutive timestamps. type: number - contextPath: IntervalAnalysis.HighFrequencyDetected description: Indicates whether a high frequency of intervals within a short time window was detected. type: boolean - contextPath: IntervalAnalysis.ConsistentIntervalsDetected description: Indicates whether the intervals between timestamps were consistent based on the standard deviation threshold. type: boolean - contextPath: IntervalAnalysis.IsPatternLikelyAutomated description: Indicates whether the pattern of intervals is likely automated based on analysis. Intervals with high frequency or consistency can suggest the use of an automation. type: boolean scripttarget: 0 subtype: python3 runonce: false dockerimage: demisto/python3:3.12.13.10404775 runas: DBotWeakRole engineinfo: {} fromversion: 6.10.0 tests: - No tests (auto formatted)