From 2ad2d68c4a8840e94c982b930dbb735925d6da43 Mon Sep 17 00:00:00 2001
From: Emmanuel Ferdman <emmanuelferdman@gmail.com>
Date: Mon, 19 May 2025 19:05:07 +0300
Subject: [PATCH] Resolve datetime.utcfromtimestamp deprecation (#4719)

---
 detection_rules/utils.py | 4 ++--
 pyproject.toml           | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detection_rules/utils.py b/detection_rules/utils.py
index e33a4488a..bbc8515f6 100644
--- a/detection_rules/utils.py
+++ b/detection_rules/utils.py
@@ -18,7 +18,7 @@ import shutil
 import subprocess
 import zipfile
 from dataclasses import is_dataclass, astuple
-from datetime import datetime, date
+from datetime import datetime, date, timezone
 from pathlib import Path
 from typing import Dict, Union, Optional, Callable
 from string import Template
@@ -303,7 +303,7 @@ def unix_time_to_formatted(timestamp):  # type: (int|str) -> str
         if timestamp > 2 ** 32:
             timestamp = round(timestamp / 1000, 3)
 
-        return datetime.utcfromtimestamp(timestamp).strftime('%Y-%m-%dT%H:%M:%S.%f')[:-3] + 'Z'
+        return datetime.fromtimestamp(timestamp, timezone.utc).strftime('%Y-%m-%dT%H:%M:%S.%f')[:-3] + 'Z'
 
 
 def normalize_timing_and_sort(events, timestamp='@timestamp', asc=True):
diff --git a/pyproject.toml b/pyproject.toml
index 783994a2e..443b6183f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.2.5"
+version = "1.2.6"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"