Cortex XDR Pro - XQL Query - weekend monitoring

RFeyertag — Sat, 03 Feb 2024 18:21:33 GMT

Hello dear community,

is there a way to setup bioc rules only for the scope weekend? I tried a little bit, but couldn't get it done.

Thank you

Rob

Re: Cortex XDR Pro - XQL Query - weekend monitoring

zarnous — Sun, 04 Feb 2024 01:41:25 GMT

You can get more granularity in terms of query schedule more with correlation rule.
There you can utilize the Cron Expression in your time schedule and you can configure the wekend expesion that you are looking for.

Knowing that :

1-5 in Cron expression is Monday to Friday
6=Saturday 0=Sunday.

For example, the below query will run every 2 hours, at the top of the hour on the weekends

I hope that was helpful and answered your question , if so please feel free to mark this as a solution so others can benefit from.

Thanks!
Zee

topic Cortex XDR Pro - XQL Query - weekend monitoring in Cortex XDR Discussions

Cortex XDR Pro - XQL Query - weekend monitoring

Re: Cortex XDR Pro - XQL Query - weekend monitoring