This is a string, up to 255 characters, giving the time of the original event that this service incident relates to. Admins use it to build an accurate timeline of when the underlying hardware or software event actually occurred, as distinct from when the incident was processed. For example, comparing this field to the time the incident was received helps the admin see how much delay occurred in escalation.