Nicole,
Thanks for your response.
As we have nodes located in different time-zones; I believe it would make sense to have the “DetectionTime” always reflect the local time of the node. For example, I intend to be develop filters/rules based on time-of-day criteria. As the “DetectionTime” is currently “normalized”; this could be problematic when developing filters/rules based on times-of-day; as I would need to keep of which nodes were in different time-zones.
My suggestion (feature request) would be to either not localize the “DetectionTime” or to include an additional field for all events that would reflect the local time of the node.