The epoch marker helps here as well, but indirectly. If you have the ability in your SIEM to locate the earliest unixTime's for a particular epoch, those are the results of the first runs.