Cortex XDR Pro - XQL Query - weekend monitoring

[RFeyertag]

Hello dear community, 

is there a way to setup bioc rules only for the scope weekend? I tried a little bit, but couldn't get it done. 

Thank you

BR

Rob

[zarnous]

Hi @RFeyertag ,

You can get more granularity in terms of query schedule more with correlation rule.
There you can utilize the Cron Expression in your time schedule and you can configure the wekend expesion that you are looking for.

Knowing that :

1-5 in Cron expression is Monday to Friday
6=Saturday 0=Sunday.

For example, the below query will run every 2 hours, at the top of the hour on the weekends 

I hope that was helpful and answered your question , if so please feel free to mark this as a solution so others can benefit from.

Thanks!
Zee