Skip to content
Mimir

Time & Display

Time & Display

The first panel under Settings → Account is the only one that matters across every Mimir page you’ll ever open: every timestamp you see — heartbeats, alerts, hunt results, IOC last_seen, agent enrollment — runs through your account’s time preferences before it renders. The defaults are sensible (UTC, 24-hour, the Expanded “2m ago · 14:58:00 UTC” form that pairs relative ages with absolute times), but most operators want their local clock in their local locale within five minutes of signing in.

This panel is per-user, not per-tenant. Two operators on the same Mimir deployment can have completely different timezone and format preferences without affecting each other.

What you get

Three controls and a live preview:

  • Timezone — a dropdown of every IANA timezone your browser knows about. UTC and your browser-detected timezone are pinned to the top for quick selection; everything else (Europe/Berlin, America/Denver, Asia/Tokyo, etc.) lives in the long alphabetical list below.
  • Hour format — radio buttons for 24-hour (14:58:00) or 12-hour (2:58:00 PM). Affects every absolute time on every page.
  • Display format — radio buttons for how a single timestamp is composed:
    • Compact — 2m ago only. Densest, best for the Alerts and Hosts pages where you’re scanning hundreds of rows.
    • Expanded — 2m ago · 14:58:00 UTC inline. Both forms in one cell. Heavier but unambiguous.
    • Absolute only — 14:58:00 UTC. No relative shorthand at all. Some operators prefer this when correlating across systems where “ago” gets confusing across timezones.
  • Preview — a small Preview: … strip below the controls renders a sample 2-minutes-ago timestamp in your pending selection so you can see what the format change will look like before saving.

If you log in for the first time and Mimir’s defaults (UTC, 24-hour, Expanded) don’t match your browser’s timezone, the panel shows a small yellow-bordered banner at the top:

Showing times in UTC. Your browser detected Europe/Berlin — [Use this] [✕]

Clicking Use this saves the browser-detected timezone immediately (no need to also click Save). The ✕ dismisses the banner for the session.

How to use it

  1. Open Settings → Account.
  2. Pick your Timezone from the dropdown. The dropdown supports keyboard search — type the start of a city name to jump.
  3. Pick 24-hour or 12-hour under Hour format.
  4. Pick Compact, Expanded, or Absolute only under Display format.
  5. Watch the Preview strip to confirm the result.
  6. Click Save. The button is disabled until you’ve actually changed something — if the value matches what’s already saved, there’s nothing to do.

The page caches an “unsaved change” indicator next to the Save button so you don’t accidentally navigate away with pending edits.

Where these settings apply

Everywhere a timestamp renders. Concretely:

  • Hosts list and detail — last-seen, enrolled-at, agent and osquery version-pinned dates.
  • Alerts feed — detected-at, acknowledged-at, dedup window countdowns.
  • Hunts — launched-at, completed-at, per-host response time.
  • Indicators — first-seen, last-seen, decay timestamps.
  • Campaigns — frozen-snapshot-at, assignment-lease expirations, late-match arrival times.
  • Settings → API Keys and Enrollment Secrets — created-at, last-used-at, revoked-at.

Mimir does not store timestamps in your timezone — every value is stored in UTC server-side and converted at render time. Switching your preference from UTC to Asia/Tokyo will not “shift” old rows; it just renders them in the new locale.

Why three display formats

The three formats trade off scanability against unambiguity:

  • Compact is fastest to read at a glance (“how recent is this?”) but loses information when “2m ago” or “1h ago” buckets multiple events into the same label.
  • Absolute only is unambiguous but slower to translate (“was 14:58 UTC recent? let me check the time…”).
  • Expanded is the compromise — relative for the scan, absolute for the cross-reference. The most operator-friendly default on busy triage screens.

If you’re switching between Mimir and an external SIEM that only shows absolute times, Expanded or Absolute only lines up the correlation cleanly. If you’re solo-triaging Mimir most of the day, Compact is easier on the eyes.

Troubleshooting

The timezone dropdown is empty or only shows UTC. The dropdown is populated from Intl.supportedValuesOf('timeZone'). Very old browsers (or some corporate locked-down browsers) don’t expose this API; the panel falls back to UTC-only in that case. Use a current Chromium, Firefox, or Safari to see the full list.

“Save” is greyed out even though I changed something. Mimir compares your pending selection against your last saved preferences. If you toggled a radio and toggled it back, there’s nothing to save.

My timestamps still show UTC after saving. Refresh the page once. The preference is fetched at app boot and cached for the session; other open tabs pick up the new value on their next render.

The browser-suggested timezone is wrong. Your OS-level timezone setting controls what the browser reports. Mimir trusts the browser verbatim. Fix the OS timezone (Windows: Settings → Time & language; macOS: System Settings → General → Date & Time) and reopen the page.