Catch the current datetime from my country

[brucelourenco]

Hello all!
I'm using the Detect class and get_detect_summaries method to get the details of the detections on the console.
It is running accordingly, however, when I compare the last_behavior field between the console dashboard and the json resulted I see a difference of 3 hours between them, like:

CONSOLE TIME
May. 16, 2022 23:12:47

API JSON TIME
2022-05-17T02:12:47Z

I'm in Brazil and I use the US-1 address: https://falcon.crowdstrike.com/

Does anyone know how to set to get the timestamp from my region via API?

Thank you

[jshcodes]

Hu @brucelourenco -

There are a few ways to solve this problem, for this scenario I went with a couple of imports. (python-dateutil, pytz)

Side note: I guessed at your timezone. You can get a complete list from pytz.all_timezones_set.

from datetime import datetime
from falconpy import Detects
import pytz
from dateutil import parser

# Connect to the API
detects = Detects(client_id="FALCON_CLIENT_ID", client_secret="FALCON_CLIENT_SECRET")
# Retrieve a list of detection IDs
# Note: This example is lazy, you should confirm status_code, etc. before proceeding.
detect_ids = detects.query_detects()["body"]["resources"]
# Retrieve our detection summaries - same holds true here
summaries = detects.get_detect_summaries(ids=detect_ids)["body"]["resources"]
# Loop through our detections retrieved
for detection in summaries:
    # Grab the "last_behavior" field
    detect_last_behavior = parser.parse(detection["last_behavior"])
    # Create a timestamp in our local timezone
    local_timezone = pytz.timezone("Brazil/East")
    local_datetime = detect_last_behavior.replace(tzinfo=pytz.utc)
    # Convert the UTC date time to a more aware local
    local_datetime = local_datetime.astimezone(local_timezone)
    # Output our debug results
    print(f"{str(detect_last_behavior)} vs. {str(local_datetime)}")

[brucelourenco]

Very thanks mr @jshcodes !!
Works beautifully perfect lol.