Adding exception for weekend

[S.Javeri]

Hey guys, I’m looking to exclude some detections that occurred over the weekends and could use a hand with crafting that query.

My current thought process is to add exceptions for weekend dates, but that would be a continuous task and doesn't seem very efficient in the long run.

[Mudhireddy]

// Replace 'xdr_data' with your specific dataset if different
// Replace '_time' with your actual timestamp field if different
xdr_data
| where dayofweek(_time) != 6d // Exclude Saturday
| where dayofweek(_time) != 0d // Exclude Sunday
// Add your other filters here
// | project _time, event_type, action_type

[S.Javeri]

Thanks I will test it out