Alerts with weekend trigger

[Cyber1985]

Hello dear community, 

As you know, weekends and on holidays the priority of alerts rises.   

Is there a way to trigger in XQL Rules which are only fired on weekends and on self selected holidays? 

Like on weekend anybody who opens powershell triggers an suspicious weekend alert. 

I would like to get a separation between work days and non workdays. Simple. But how to do it? 

BR

Rob

[bbarmanroy]

Hi @Cyber1985 that should be possible with extract_time().

Here's how I'd start off:

preset = xdr_process
| alter dayOfWeek = extract_time(_time , "DAYOFWEEK")

What do you suggest the next few lines to be?

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-xql-language-reference/xql-functions-...