# Can Elastic SIEM alerts be configured to work on a time basis?

**URL:** https://discuss.elastic.co/t/can-elastic-siem-alerts-be-configured-to-work-on-a-time-basis/351547
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [January 22, 2024, 2:12pm UTC](https://discuss.elastic.co/t/can-elastic-siem-alerts-be-configured-to-work-on-a-time-basis/351547 "2024-01-22T14:12:39Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Kiwisaki](https://avatars.discourse-cdn.com/v4/letter/k/dfb087/32.png) [@Kiwisaki](https://discuss.elastic.co/u/Kiwisaki)
#### Post date: [January 22, 2024, 2:12pm UTC](https://discuss.elastic.co/t/can-elastic-siem-alerts-be-configured-to-work-on-a-time-basis/351547/1 "2024-01-22T14:12:39Z")

</div>

Hi,

Is it possible to configure alerts to work on a clock ?  
I.e, i want some alarms to trigger during out of hours or weekends, but not during mon-fri hours. Is this possible ?

Additionally,  
Can you stack events and correlate for alerting?  
example: You have a rule that triggers if EVID 1234 is seen. However what i want is an exception whereby if EVID 5678 is seen from the same user that triggered EVID 1234 within a couple of minutes, dont alert. Only alert if EVID 1234 is seen without EVID 5678.

Hope ive explained this okay.

Many thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 19, 2024, 2:12pm UTC](https://discuss.elastic.co/t/can-elastic-siem-alerts-be-configured-to-work-on-a-time-basis/351547/2 "2024-02-19T14:12:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
