Digital Developer Conference: a FREE half-day online conference focused on AI & Cloud – North America: Nov 2 – India: Nov 9 – Europe: Nov 14 – Asia Nov 23 Register now

Close outline
  • United States
IBM?
  • Site map
IBM?
  • Marketplace

  • Close
    Search
  • Sign in
    • Sign in
    • Register
  • IBM Navigation
IBM Developer Answers
  • Spaces
    • Blockchain
    • IBM Cloud platform
    • Internet of Things
    • Predictive Analytics
    • Watson
    • See all spaces
  • Tags
  • Users
  • Badges
  • FAQ
  • Help
Close

Name

Community

  • Learn
  • Develop
  • Connect

Discover IBM

  • ConnectMarketplace
  • Products
  • Services
  • Industries
  • Careers
  • Partners
  • Support
10.190.13.195

Refine your search by using the following advanced search options.

Criteria Usage
Questions with keyword1 or keyword2 keyword1 keyword2
Questions with a mandatory word, e.g. keyword2 keyword1 +keyword2
Questions excluding a word, e.g. keyword2 keyword1 -keyword2
Questions with keyword(s) and a specific tag keyword1 [tag1]
Questions with keyword(s) and either of two or more specific tags keyword1 [tag1] [tag2]
To search for all posts by a user or all posts with a specific tag, start typing and choose from the suggestion list. Do not use a plus or minus sign with a tag, e.g., +[tag1].
  • Ask a question

Offense Rule for activity out of business hours

50YNY2VUCF gravatar image
Question by FabFD  (45) | Mar 25 at 09:07 AM qradarrulesaqloffensescorrelation

Hi,

I want to create an offense rule that fires, when events with certain QIDs occur out of business hours, lets say when they occur out of 8 am - 5 pm. How can I realize that in an offense rule? As far as I can see I only have the rule part "When the events occur before/after", which I can link with an AND-conjunction. What I need is:

When the events occur before 8 am OR after 5 pm. Is there any posibility to do it this way?

Regards, Fab

People who like this

  0
Comment
10 |3000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster

2 answers

  • Sort: 
2700060Q4C gravatar image
Accepted answer

Answer by Rory@IBM (121) | Mar 25 at 09:40 AM

Creating a single rule that matches events from non-contiguous time periods (i.e. the period before 8:00 as well as the period after 17:00) can't be done with a single rule. It is easy to match events from the single time period from 8:00 to 17:00, though. Probably the best way to address this is with a Building Block for during business that contains a definition like:

alt text

And then use that BB in another rule that negates it, like so:

alt text


events-during-business-hours.png (14.4 kB)
events-not-during-business-hours.png (11.8 kB)
Comment

People who like this

  0   Share
10 |3000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
3100029RV2 gravatar image

Answer by JamesMcLarenJersey (15) | Mar 25 at 09:42 AM

@FabFD

You could do this with building blocks to spec the time. Create one to spec if the time is before working hours, and a second for after hours; then I think you can use the simple function to look for any of the two BBs you've created, alongside your QID search.

Does that help?

James

Comment

People who like this

  0   Show 1   Share
10 |3000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
50YNY2VUCF gravatar image FabFD (45)   Apr 04 at 06:57 AM 0
Share

Hi James, thanks for this hint. I will try this if I dont have success with Rory's method.

Regards, Fab

Follow this question

173 people are following this question.

Answers

Answers & comments

Related questions

Announcement: QVM Externally Hosted Scans (March 1st - power outtage) 0 Answers

Correlation payloads text & create rule 5 Answers

Qradar UNIQUECOUNT AQL not working as planned 1 Answer

Graph of offenses created more than X days ago 0 Answers

Offense Indexing of "event(s) have not been detected" Rules on Log Source Name 0 Answers

  • Contact
  • Privacy
  • IBM Developer Terms of use
  • Accessibility
  • Report Abuse
  • Cookie Preferences

Powered by AnswerHub

Authentication check. Please ignore.
  • Anonymous
  • Sign in
  • Create
  • Ask a question
  • Spaces
  • API Connect
  • Analytic Hybrid Cloud Core
  • Application Performance Management
  • Appsecdev
  • BPM
  • Blockchain
  • Business Transaction Intelligence
  • CAPI
  • CAPI SNAP
  • CICS
  • Cloud Analytics
  • Cloud Automation
  • Cloud Object Storage
  • Cloud marketplace
  • Collaboration
  • Content Services (ECM)
  • Continuous Testing
  • Courses
  • Customer Experience Analytics
  • DB2 LUW
  • Data and AI
  • DataPower
  • Decision Optimization
  • DevOps Build
  • DevOps Services
  • Developers IBM MX
  • Digital Commerce
  • Digital Experience
  • Finance
  • Global Entrepreneur Program
  • Hadoop
  • Hybrid Cloud Core
  • Hyper Protect
  • IBM Cloud platform
  • IBM Design
  • IBM Forms Experience Builder
  • IBM Maximo Developer
  • IBM StoredIQ
  • IBM StoredIQ-Cartridges
  • IIDR
  • ITOA
  • InformationServer
  • Integration Bus
  • Internet of Things
  • Kenexa
  • Linux on Power
  • LinuxONE
  • MDM
  • Mainframe
  • Messaging
  • Node.js
  • ODM
  • Open
  • PartnerWorld Developer Support
  • PowerAI
  • PowerVC
  • Predictive Analytics
  • Product Insights
  • PureData for Analytics
  • Push
  • QRadar App Development
  • Run Book Automation
  • Search Insights
  • Security Core
  • Storage
  • Storage Core
  • Streamsdev
  • Supply Chain Business Network
  • Supply Chain Insights
  • Swift
  • UBX Capture
  • Universal Behavior Exchange
  • UrbanCode
  • WASdev
  • WSRR
  • Watson
  • Watson Campaign Automation
  • Watson Content Hub
  • Watson Marketing Insights
  • dW Answers Help
  • dW Premium
  • developerWorks Sandbox
  • developerWorks Team
  • Watson Health
  • More
  • Tags
  • Questions
  • Users
  • Badges