# How to Create a Rule Based on Time Range

**URL:** <https://discuss.elastic.co/t/how-to-create-a-rule-based-on-time-range/318998>\
**Category:** Kibana\
**Tags:** detection-rules\
**Created:** [November 15, 2022, 8:06pm UTC](https://discuss.elastic.co/t/how-to-create-a-rule-based-on-time-range/318998 "2022-11-15T20:06:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElasticUser11](https://avatars.discourse-cdn.com/v4/letter/e/ee59a6/32.png) [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\
**Post date:** [November 15, 2022, 8:06pm UTC](https://discuss.elastic.co/t/how-to-create-a-rule-based-on-time-range/318998/1 "2022-11-15T20:06:27Z")

</div>

I'm trying to create a rule that detects when users login outside business hours (7AM-6PM). I believe this can be done with machine Learning, but I don not have that type of subscription. So, I've tried several ways, albeit all unsuccessful.

The latest batch of attempts involve RegEx, with this being my current one:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4d68ceac1f3ba06144527aff91d62358fd221585.png)

However, when running the preview, I get this error, obviously related to my syntax. Although the RegEx is good, I'm not sure if this is the way to go about.

![image](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5f9a7cbfecc12b6995dd2250cd144fb07d912dd.png)

Any help is greatly appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 13, 2022, 8:06pm UTC](https://discuss.elastic.co/t/how-to-create-a-rule-based-on-time-range/318998/2 "2022-12-13T20:06:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.