The ESA Rule Failed Logins Outside Business Hours change the event time to UTC +3:00. The correct event time is 09:38:41. Why Raw Log is 12:38:41?
Fri Dec 18 12:38:41 2020
Time Zone of the Netwitness hosts and Windows Domain controller is GMT -3