# I want to monitor the creation of an AD account between 9 a.m. and 5 p.m **URL:** \ **Category:** Kibana\ **Created:** [April 9, 2024, 5:07pm UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095 "2024-04-09T17:07:55Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Syphax](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Syphax](https://discuss.elastic.co/u/Syphax)\ **Post date:** [April 9, 2024, 5:07pm UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095/1 "2024-04-09T17:07:56Z")
Hi every one, I want to create a KQL rule to detect all accounts created outside of working hours. I used @timestamp but it shows me an errors what I did but it didn't work: event.code: "4726" and (@timestamp\>= 09:00 and @timestamp\<=17:00) the error is in the @timestamp part Thanks ---
**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\ **Post date:** [April 10, 2024, 5:39am UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095/2 "2024-04-10T05:39:21Z")
Hello, Which part of the UI are you using this KQL query on? The @timestamp values need to respect the accepted timestamp formats. > **[format | Elasticsearch Guide \[8.13\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html#custom-date-formats)** I am attaching how sample timestamp will look like in discover. Can you please check how you are ingesting your @timestamp and the value format and try again? ![Screenshot 2024-04-10 at 11.08.04 AM](https://us1.discourse-cdn.com/elastic/original/3X/1/5/1553fbbc8e9e5f6b8e8cc4ae96d69b872519aa5c.png) Thanks, Bhavya ---
**Author:** ![Syphax](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Syphax](https://discuss.elastic.co/u/Syphax)\ **Post date:** [April 10, 2024, 9:06am UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095/3 "2024-04-10T09:06:38Z")
Thank you Bhavya for your response, I use "Discover" and I want to create a use case which will monitor in the future (or in past logs) any account creation outside the interval from 9 a.m. to 5 p.m. i.e. outside of working hours. I tested a lot of KQL rules but it didn't work ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 10, 2024, 12:31pm UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095/4 "2024-04-10T12:31:05Z")
This is not possible without changing your data. When filtering by the timestamp you need to pass the entire date, so you cannot filter just by the hours, you would need to change the filter everyday to add the year, month and day. What you can do is during the parsing of your data create a new field with just the numeric value of the hour, like 09 and 17, and then filter using those values. ---
**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\ **Post date:** [April 10, 2024, 12:54pm UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095/5 "2024-04-10T12:54:15Z")
@syphax please see @leandrojmp response below. It will also help if you can please post the error screenshot. @leandrojmp thanks for helping the community. Thanks, Bhavya ---
**Author:** ![Syphax](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Syphax](https://discuss.elastic.co/u/Syphax)\ **Post date:** [April 12, 2024, 7:43pm UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095/6 "2024-04-12T19:43:03Z")
Hi everyone, as you can see in the capture, on the left it was an extract from a log and on the right my KQL query in Discover. in the request: event.code: "556" and @timestamp \<= "Apr 12, 2024 @ 21:25:15.650" I tried all the operators (: , \<= , \>= ) and it still displays an error (to the right of the capture). @leandrojmp in what you say here "What you can do is during the parsing of your data create a new field with just the numeric value of the hour, like 09 and 17, and then filter using those values." I don't understand it well but I'm going to find out how I can do it ![KQL ERROR](https://us1.discourse-cdn.com/elastic/original/3X/4/5/452e24aae41c20500fd53e63c14a194c53e4c3b6.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 12, 2024, 10:38pm UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095/7 "2024-04-12T22:38:51Z")
The correct way to filter using `@timestamp` is something like this: ```auto @timestamp >= "2024-04-12T19:25:00.000" ``` > [@Syphax](#): > > What you can do is during the parsing of your data create a new field with just the numeric value of the hour, like 09 and 17, and then filter using those values. What I mean is that during the parsing of your data you need to extract the value of the hour from your date string and store it on another field, then use this other field to filter. For example, for a date string like this: `Apr 12, 2024 @ 21:25:15.650`, you would extract the hour, which is `21`, then you could store it on a field named `date_hour` and filter in kibana like this: ```auto date_hour >= 9 and date_hour <= 17 ``` How you will do that depends on how you are ingesting your data, which tools you are using etc ---
**Author:** ![Syphax](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Syphax](https://discuss.elastic.co/u/Syphax)\ **Post date:** [April 13, 2024, 8:22am UTC](https://discuss.elastic.co/t/i-want-to-monitor-the-creation-of-an-ad-account-between-9-a-m-and-5-p-m/357095/8 "2024-04-13T08:22:55Z")
thank you for your answers I will try the idea that @leandrojmp proposed to me and I'm going to develop a parser