topic Re: Alerts with weekend trigger in Cortex XDR Discussions

Alerts with weekend trigger

Cyber1985 — Sat, 19 Nov 2022 10:04:06 GMT

Hello dear community,

As you know, weekends and on holidays the priority of alerts rises.

Is there a way to trigger in XQL Rules which are only fired on weekends and on self selected holidays?

Like on weekend anybody who opens powershell triggers an suspicious weekend alert.

I would like to get a separation between work days and non workdays. Simple. But how to do it?

Rob

bbarmanroy — Tue, 22 Nov 2022 07:54:52 GMT

Hi @Cyber1985 that should be possible with extract_time().

Here's how I'd start off:

preset = xdr_process | alter dayOfWeek = extract_time(_time , "DAYOFWEEK")

What do you suggest the next few lines to be?