# Detection Rule During Specific Hours

**URL:** <https://discuss.elastic.co/t/detection-rule-during-specific-hours/338493>\
**Category:** Elastic Security\
**Created:** [July 17, 2023, 2:19am UTC](https://discuss.elastic.co/t/detection-rule-during-specific-hours/338493 "2023-07-17T02:19:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![SomeRobot](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@SomeRobot](https://discuss.elastic.co/u/SomeRobot)\
**Post date:** [July 17, 2023, 2:19am UTC](https://discuss.elastic.co/t/detection-rule-during-specific-hours/338493/1 "2023-07-17T02:19:50Z")

</div>

We need to write a detection rule that only looks for matches between specific hours of the day, say 12AM - 4AM EST. I assume there is a way to do this, because it would be a huge oversight if there wasn't, but I can't seem to figure it out, and I can't find any examples. Anyone have a link to the docs on this, or can give a quick overview?  
Thanks

---

<div class="post-metadata">

**Author:** ![SomeRobot](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@SomeRobot](https://discuss.elastic.co/u/SomeRobot)\
**Post date:** [July 27, 2023, 4:30am UTC](https://discuss.elastic.co/t/detection-rule-during-specific-hours/338493/2 "2023-07-27T04:30:26Z")

</div>

I guess muting is the best way to do this.

---

<div class="post-metadata">

**Author:** ![isorokopud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/isorokopud/32/119989_2.png) [@isorokopud](https://discuss.elastic.co/u/isorokopud)\
**Post date:** [July 27, 2023, 11:41am UTC](https://discuss.elastic.co/t/detection-rule-during-specific-hours/338493/3 "2023-07-27T11:41:36Z")

</div>

Hi there 👋

We introduced [Maintenance Windows](https://www.elastic.co/guide/en/kibana/8.8/maintenance-windows.html#maintenance-windows) in 8.8. I think this is what you are looking for. Maintenance windows will suppress all notification during the specified period.

Many thanks,  
Zhenia

---

<div class="post-metadata">

**Author:** ![SomeRobot](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@SomeRobot](https://discuss.elastic.co/u/SomeRobot)\
**Post date:** [August 3, 2023, 3:24am UTC](https://discuss.elastic.co/t/detection-rule-during-specific-hours/338493/4 "2023-08-03T03:24:54Z")

</div>

Ya this is what I ended up using. I was calling it 'muting' but this is the correct answer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2023, 3:25am UTC](https://discuss.elastic.co/t/detection-rule-during-specific-hours/338493/5 "2023-08-31T03:25:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.