# Using Relative Time in the rule to create alerts

**URL:** <https://discuss.elastic.co/t/using-relative-time-in-the-rule-to-create-alerts/371877>\
**Category:** Elasticsearch\
**Created:** [December 12, 2024, 12:22am UTC](https://discuss.elastic.co/t/using-relative-time-in-the-rule-to-create-alerts/371877 "2024-12-12T00:22:03Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aryaman\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aryaman_singh/32/139948_2.png) [@Aryaman\_Singh](https://discuss.elastic.co/u/Aryaman_Singh)\
**Post date:** [December 12, 2024, 12:22am UTC](https://discuss.elastic.co/t/using-relative-time-in-the-rule-to-create-alerts/371877/1 "2024-12-12T00:22:03Z")

</div>

Hi,

I wanted to understand a way where

1. We can use relative timestamps inside a rule to generate alerts in respect to the time we have received a certain kind of log.
2. Not generate an alert for the logs whose vulnerability has already been fixed (we have received "fixed" logs in the SIEM).

For example - We have a vulnerability scanner which sends logs for every vulnerability found and a log for every vulnerability fixed. I want to make sure that I generate an alert after every 14 days that vulnerability (log was created in the SIEM) is still not fixed. There needs to be a query which removes the vulnerability log which has already been fixed and generate alerts for the rest of them.

Thank you!