Snort Alerts: Date filter does not accept the date format displayed in the table

[jsokorp]

Howdy,

The Snort Alerts Date filter searches the raw MM/DD/YY timestamp, but the Alerts table displays YYYY-MM-DD. Please make the filter accept the displayed format, or provide a visible hint explaining the required format.

Environment:

• pfSense CE 2.9.0-RELEASE
• Snort package 4.1.10
• Package dependency shown: snort-2.9.20_9

Reproduction, with Exact Match unchecked:

• The Alerts table displays a date such as 2026-09-17.
• Entering 2026-09-17 in the Date filter returns no results.
• Entering 09/17/26 returns the expected results.
• All other filter fields were cleared for this test.

Usability issue: users naturally copy the displayed date from the Alerts table into the Date filter. The copied value does not work, while the undocumented raw-log format does.

The installed Alerts page shows that filtering occurs before the date is reformatted for display:

[2.9.0-RELEASE][admin@pfSense.prokos.me]/root: grep -n -F -A 12 'snort_match_filter_field($fields' /usr/local/www/snort/snort_alerts.php
867:            if ($filterlogentries && !snort_match_filter_field($fields, $filterfieldsarray, $filterlogentries_exact_match)) {
868-                continue;
869-            }
870-
871-            /* Time */
872-            $alert_time = substr($fields[0], strpos($fields[0], '-')+1, -8);
873-            /* Date */
874-            $alert_date = substr($fields[0], 0, strpos($fields[0], '-'));
875-            if (($event_date = strtotime($alert_date)) !== false) {
876-                $alert_date = date('Y-m-d', $event_date);
877-            }
878-            /* Description */
879-            $alert_descr = $fields[4];

The raw alert file begins timestamps in this format:

09/17/26-15:45:49.123456

The page filters that original value, then converts it to YYYY-MM-DD for display. This makes the displayed date unusable as the filter value.