Detection Rule During Specific Hours

Elastic Security
1

We need to write a detection rule that only looks for matches between specific hours of the day, say 12AM - 4AM EST. I assume there is a way to do this, because it would be a huge oversight if there wasn't, but I can't seem to figure it out, and I can't find any examples. Anyone have a link to the docs on this, or can give a quick overview?
Thanks

2

I guess muting is the best way to do this.

3

Hi there :wave:

We introduced Maintenance Windows in 8.8. I think this is what you are looking for. Maintenance windows will suppress all notification during the specified period.

Many thanks,
Zhenia

4

Ya this is what I ended up using. I was calling it 'muting' but this is the correct answer.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.