Can Elastic SIEM alerts be configured to work on a time basis?


Is it possible to configure alerts to work on a clock ?
I.e, i want some alarms to trigger during out of hours or weekends, but not during mon-fri hours. Is this possible ?

Can you stack events and correlate for alerting?
example: You have a rule that triggers if EVID 1234 is seen. However what i want is an exception whereby if EVID 5678 is seen from the same user that triggered EVID 1234 within a couple of minutes, dont alert. Only alert if EVID 1234 is seen without EVID 5678.

Hope ive explained this okay.

Many thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.