# Create a rule that alerts on out of hours

**URL:** <https://discuss.elastic.co/t/create-a-rule-that-alerts-on-out-of-hours/326351>\
**Category:** Elastic Security\
**Tags:** detection-rules\
**Created:** [February 23, 2023, 4:47pm UTC](https://discuss.elastic.co/t/create-a-rule-that-alerts-on-out-of-hours/326351 "2023-02-23T16:47:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex.W](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Alex.W](https://discuss.elastic.co/u/Alex.W)\
**Post date:** [February 23, 2023, 4:47pm UTC](https://discuss.elastic.co/t/create-a-rule-that-alerts-on-out-of-hours/326351/1 "2023-02-23T16:47:59Z")

</div>

Hello,

I have just started using Elastic and am trying to create a rule that will alert for role assignment changes in AzureAD out of office hours.

Using @timestamp appears to be the option but I cant seem to have it look at a specific time range eg. 17:00 - 09:00

I am not sure what else you may need but if anyone can assist it would be appreciated.

Thanks,

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [February 23, 2023, 4:53pm UTC](https://discuss.elastic.co/t/create-a-rule-that-alerts-on-out-of-hours/326351/2 "2023-02-23T16:53:32Z")

</div>

To my knowledge, there isn't a direct way to limit when a rule runs. However, a work around for this is adding a [scheduled snooze](https://www.elastic.co/guide/en/kibana/8.6/create-and-manage-rules.html#controlling-rules) to your rule. This way your rule will always run, but only send alerts when the scheduled snooze isn't active. The one downside of this approach is that if something triggers your rule during the "snoozed" period, you won't receive an alert when the "snooze" period ends.

---

<div class="post-metadata">

**Author:** ![Alex.W](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Alex.W](https://discuss.elastic.co/u/Alex.W)\
**Post date:** [February 24, 2023, 2:28pm UTC](https://discuss.elastic.co/t/create-a-rule-that-alerts-on-out-of-hours/326351/3 "2023-02-24T14:28:02Z")

</div>

Thanks BenB196, this has done the trick. Appreciated.

---

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [February 24, 2023, 2:50pm UTC](https://discuss.elastic.co/t/create-a-rule-that-alerts-on-out-of-hours/326351/4 "2023-02-24T14:50:11Z")

</div>

No problem. It also looks like Elastic opened a new enhancement to formalize this type of thing as well: [[E&C][RAM] [META] Conditional Actions · Issue #152026 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/152026)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2023, 2:50pm UTC](https://discuss.elastic.co/t/create-a-rule-that-alerts-on-out-of-hours/326351/5 "2023-03-24T14:50:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.