Documentation Index
Fetch the complete documentation index at: https://docs.esperr.com/llms.txt
Use this file to discover all available pages before exploring further.
What is a Timestamp?
A timestamp records exactly when Esper observed a request. It’s essential for understanding patterns, detecting attacks, and analyzing behavior over time.MDN Web DocsRead more on the Date header.
Timestamp Formats
ISO 8601 (Recommended)
Unix Timestamp
Components
- Date: 2024-03-19
- Time: 10:15:30
- Milliseconds: .000
- Timezone: Z or +00:00 (UTC)
Using Timestamps in Policies
Basic Examples
Business hours only:Advanced Time Windows
Rate limiting with time windows:Time-Based Attack Patterns
Timing Attacks
| Pattern | What to Look For | Detection Strategy |
|---|---|---|
| Brute Force | Rapid sequential attempts | High frequency, short window |
| Slow Brute Force | Spread out attempts | Lower frequency, longer window |
| Time-of-Day Attacks | Off-hours activity | Business hours check |
| Coordinated Attacks | Synchronized timing | Multiple IPs, same second |
Impossible Travel
Working with Time Windows
Window Types
Fixed Windows:Best Practices
DO:
- Use UTC for consistency across timezones
- Include milliseconds for precise ordering
- Set appropriate windows for your use case
- Consider timezone of legitimate users
- Account for clock skew between systems
- Log timestamp mismatches for investigation
DON’T:
- Rely on client timestamps - Use server time
- Ignore timezone differences - Can cause false positives
- Use overly tight windows - Network delays happen
- Forget about DST - Daylight saving time changes
- Block based on time alone - Combine with other signals
Time Zone Considerations
Global Operations
UTC Best Practice
Behavioral Analysis
Session Duration
Activity Patterns
Velocity Checks
Common Issues
Clock Synchronization
Problem: Servers have different times Solution: Use NTP for time syncTimezone Confusion
Problem: Mixing local and UTC times Solution: Standardize on UTCMillisecond Precision
Problem: Losing order of rapid events Solution: Include milliseconds/microsecondsAdvanced Patterns
Business Logic Enforcement
Scheduled Maintenance
Correlation Windows
Forensics and Investigation
Timeline Analysis
Pattern Identification
Integration with Other Fields
Time + IP Analysis
Time + User Behavior
Troubleshooting
“False positives at midnight”- Check timezone handling
- Verify date rollover logic
- Account for UTC vs local time
- Confirm window boundaries
- Check inclusive/exclusive logic
- Verify timestamp precision
- Analyze actual traffic patterns
- Adjust windows and thresholds
- Consider business patterns
Related Fields
- Client IP - Track per-IP time patterns
- Cookies - Session duration tracking
- Request Path - Time-based access control
- User Agent - Traffic protection with timing