This value carries the date and time of a CLI security alert, delivered as part of the usdCliSecurityAlert notification alongside its priority and message text, per the source description. A security administrator uses this timestamp to build an accurate timeline of security-relevant CLI events like logins and authentication attempts when investigating an incident. For example, this field might carry a timestamp precisely marking when a flagged SSH login from an unknown IP address occurred.