Which flow fields should be used to determine how long a session has been active on a network?

The duration of a network session in QRadar is determined by the time elapsed between the first and last packets of that communication flow. The "Start time" field captures the timestamp of the initial packet that established the session. The "Last packet time" field is updated with the timestamp of each subsequent packet, ultimately reflecting when the session's last activity was observed. The difference between these two timestamps provides the total active duration of the session.

A: "End time" is not the standard QRadar terminology for a flow field; "Last packet time" is the correct and specific field name. B: "Storage time" indicates when QRadar wrote the flow record to the database, which is an internal metric unrelated to network session activity. D: This combination lacks the "Start time," making it impossible to calculate the session's total duration from its beginning.

1. IBM QRadar User Guide, Version 7.5.0. (Chapter: "Monitoring network activity", Section: "Flow information"): The guide describes the columns available in the Network Activity tab, which include "Start Time" and "Last Packet Time". The "Duration" is a calculated value based on these fields.

2. IBM Knowledge Center, QRadar Documentation for 7.5.0, "Flow data fields": "First Packet Time: The date and time that the first packet was seen for the flow. Last Packet Time: The date and time that the last packet was seen for the flow."