In plain English
It points to the moment something was first noticed and entered into the record. The "something" can be a specific entity, event, or activity, and the value is the date and time of that initial observation.
In context
Here, it indicates the date and time when that device or access source was first observed and recorded.
- Situation
- Checking sessions, devices, login history, and unusual access activity
- What it communicates
- labels when a device or access source was first recorded
Meaning limits
By itself, this term does not show whether anything changed after that first recorded observation.
Examples
“The report gives the smoke plume's first seen as 03:14, although it remained visible for hours.”
“Use the tablet's first seen to place it in the morning timeline.”