Hi,
I want to create an offense rule that fires, when events with certain QIDs occur out of business hours, lets say when they occur out of 8 am - 5 pm. How can I realize that in an offense rule? As far as I can see I only have the rule part "When the events occur before/after", which I can link with an AND-conjunction. What I need is:
When the events occur before 8 am OR after 5 pm. Is there any posibility to do it this way?
Regards, Fab
Answer by Rory@IBM (121) | Mar 25 at 09:40 AM
Creating a single rule that matches events from non-contiguous time periods (i.e. the period before 8:00 as well as the period after 17:00) can't be done with a single rule. It is easy to match events from the single time period from 8:00 to 17:00, though. Probably the best way to address this is with a Building Block for during business that contains a definition like:
And then use that BB in another rule that negates it, like so:
Answer by JamesMcLarenJersey (15) | Mar 25 at 09:42 AM
You could do this with building blocks to spec the time. Create one to spec if the time is before working hours, and a second for after hours; then I think you can use the simple function to look for any of the two BBs you've created, alongside your QID search.
Does that help?
James
Hi James, thanks for this hint. I will try this if I dont have success with Rory's method.
Regards, Fab
Announcement: QVM Externally Hosted Scans (March 1st - power outtage) 0 Answers
Correlation payloads text & create rule 5 Answers
Qradar UNIQUECOUNT AQL not working as planned 1 Answer
Graph of offenses created more than X days ago 0 Answers
Offense Indexing of "event(s) have not been detected" Rules on Log Source Name 0 Answers