Fix kql timezone support

msticpy/data/core/query_source.py

@@ -415,6 +415,8 @@ def _parse_param_list(param_value: str | list) -> list[Any]:
 
     @staticmethod
     def _format_datetime_default(date_time: datetime) -> str:
+        if date_time.tzinfo:
+            return date_time.isoformat(sep="T")
         return date_time.isoformat(sep="T") + "Z"
 
     @staticmethod

tests/data/test_dataqueries.py

@@ -418,10 +418,10 @@ def test_split_queries(self):
         self.assertEqual(len(queries), 6)
 
         for idx, (st_time, e_time) in enumerate(ranges):
-            self.assertIn(st_time.isoformat(sep="T") + "Z", queries[idx])
-            self.assertIn(e_time.isoformat(sep="T") + "Z", queries[idx])
-        self.assertIn(start.isoformat(sep="T") + "Z", queries[0])
-        self.assertIn(end.isoformat(sep="T") + "Z", queries[-1])
+            self.assertIn(st_time.isoformat(sep="T"), queries[idx])
+            self.assertIn(e_time.isoformat(sep="T"), queries[idx])
+        self.assertIn(start.isoformat(sep="T"), queries[0])
+        self.assertIn(end.isoformat(sep="T"), queries[-1])
 
     def test_split_queries_err(self):
         """Test queries split error conditions."""

tests/data/test_query_source.py

@@ -83,12 +83,22 @@ def setUp(self):
             )
         self.query_sources = self.la_provider.query_store.data_families
 
+    def test_date_formatters_datetime_no_tz(self):
+        """Test date formatting standard date."""
+        # standard date
+        test_end = datetime.now(tz=None)
+        test_start = test_end - timedelta(days=1)
+        check_dt_str = test_start.isoformat(sep="T") + "Z"
+        q_src = self.query_sources["SecurityAlert"]["list_related_alerts"]
+        query = q_src.create_query(start=test_start, end=test_end)
+        self.assertIn(check_dt_str, query)
+
     def test_date_formatters_datetime(self):
         """Test date formatting standard date."""
         # standard date
         test_end = datetime.now(tz=timezone.utc)
         test_start = test_end - timedelta(days=1)
-        check_dt_str = test_start.isoformat(sep="T") + "Z"
+        check_dt_str = test_start.isoformat(sep="T")
         q_src = self.query_sources["SecurityAlert"]["list_related_alerts"]
         query = q_src.create_query(start=test_start, end=test_end)
         self.assertIn(check_dt_str, query)
@@ -97,7 +107,7 @@ def test_date_formatters_datestring(self):
         """Test date formatting ISO date string."""
         test_end = datetime.now(tz=timezone.utc)
         test_start = test_end - timedelta(days=1)
-        check_dt_str = test_start.isoformat(sep="T") + "Z"
+        check_dt_str = test_start.isoformat(sep="T")
         start = test_start.isoformat()
         q_src = self.query_sources["SecurityAlert"]["list_related_alerts"]
         query = q_src.create_query(start=start, end=test_end)