E-Mail Notifications or Alert triggering only im specific time ranges

[RFeyertag]

Hello dear community, 

we need to trigger alerts only in specific time ranges. Like only at weekend or weekdays from 5 in the evening until 6 in the morning. 

In the working hours it is possible admins with the identity of the user are triggering alerts. (opening powershell). 

Is this possible with XQL?

BR

Rob

[nar]

Hi @RFeyertag 

Thanks for reaching LC!

Your question is not clear to me, do you mean that you want to trigger alerts or in other words block certain application(powershell) during specific time window? Or you are talking about alerts notification forwarding during certain time?

Regards,

[RFeyertag]

Hello! 

yes only triggering. The alerts should have a time from and time until or/and dayoftheweek from or dayoftheweek until setting. 

BR

Rob

[Fm12345]

In correlation rules we have an option to use cron expressions. Try testing out your scenario using that. Below is the link for reference.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Correlation...