topic Re: E-Mail Notifications or Alert triggering only im specific time ranges in Cortex XDR Discussions

E-Mail Notifications or Alert triggering only im specific time ranges

RFeyertag — Thu, 31 Oct 2024 00:33:02 GMT

Hello dear community,

we need to trigger alerts only in specific time ranges. Like only at weekend or weekdays from 5 in the evening until 6 in the morning.

In the working hours it is possible admins with the identity of the user are triggering alerts. (opening powershell).

Is this possible with XQL?

Rob

Re: E-Mail Notifications or Alert triggering only im specific time ranges

nar — Thu, 31 Oct 2024 04:36:19 GMT

Hi @RFeyertag

Thanks for reaching LC!

Your question is not clear to me, do you mean that you want to trigger alerts or in other words block certain application(powershell) during specific time window? Or you are talking about alerts notification forwarding during certain time?

Regards,

Re: E-Mail Notifications or Alert triggering only im specific time ranges

RFeyertag — Mon, 04 Nov 2024 13:53:10 GMT

Hello!

yes only triggering. The alerts should have a time from and time until or/and dayoftheweek from or dayoftheweek until setting.

Rob

Re: E-Mail Notifications or Alert triggering only im specific time ranges

Fm12345 — Tue, 05 Nov 2024 11:46:21 GMT

In correlation rules we have an option to use cron expressions. Try testing out your scenario using that. Below is the link for reference.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Correlation-Rule-Details