LIVEcommunity - Who rated this post

Buy or Renew

You could probably just filter out newly installed agents.

| alter install_date_difference = timestamp_diff(current_time(), install_date, "DAY") // calculate the amount of days since the XDR agent was installed.
| filter install_date_difference > 1 // Set/filter the amount of days when the correlation rule should trigger. In this example the agent needs to be installed for 2 days and more

timestamp_diff would also support the difference in hours.

Hope this helps

View solution in original post

Who rated this post

L0 Member

Rating date:

Unlock your full community experience!

Who rated this post