Replies: 3 comments 16 replies
-
|
There's an use case, there are solutions for various SIEMs. Why not 😁 |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
How write before 08h30 and after 17h00 (Monday to Friday except vacations 😄 ) ? selection_coffee:
Timestamp|hour|lt: 08
Timestamp|minute|lt: 30I think SIEM will only check 00h00/00h29 -> 07h00-07h29 selection_coffee:
Timestamp|timecheck|lt: 08h30
Timestamp|cron|lt: '30 8 * * * ' Why not add to Meta Rule correlation:
type: event_time
rules:
- add_special_group
???
condition:
??? |
Beta Was this translation helpful? Give feedback.
10 replies
-
|
Wondering if there has been traction related to this lately? |
Beta Was this translation helpful? Give feedback.
6 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Proposal for a set of modifiers to allow for conditions on datetime fields.
I suggest adding the following modifiers:
|minutes: Get the number of minutes in the hour of the datetime field. Between 0 and 59|hour: Get the number of hours in the day of the datetime field. Between 0 and 23|day: Get the number of days in the month of the datetime field. Between 1 and 31|dayofweek: Get the day of week as a number of the datetime field. Between 1 and 7 where 1 is monday and 7 is sunday.|week: Get the week of year as a number of the datetime field. Between 1 and 52.|month: Get the number of months in the year of the datetime field. Between 1 and 12.|year: Get the year number of the datetime field.Example use case
Let's say I want to create a use case to detect when a user gets added to a specific group off-hours. This is currently impossible. The proposal would allow such use cases. It would look something like this:
Most SIEM support these operations
Splunk: With
strftime()Sentinel: With functions such as
hourofday()QRadar: With
DATEFORMAT()Elastic: With
DATE_FORMAT()Logscale: With
formatTime()Thoughts?
Beta Was this translation helpful? Give feedback.
All reactions