Exception with time range

InsightIDR
1

Is it possible to apply an exception to an alert only within a specific time period?

Example: the exception should only work from Monday to Friday, from 9:00 am to 6:00 pm.

2

@eevrard the easiest way to do this would be to add an exception like

timestamp CONTAINS-ANY [“T18”,“T19”,“T20”,“T21”,“T22”,“T23”,“T00”,“T01”,“T02”,“T03”,“T04”,“T05”,“T06”,“T07”,“T08”]

David

3

Thank you @david_smith1 for your answer.
Is there a way to manage the days of the week in addition to time periods?

4

Not easily, you would need to build out a mapping manually of weekends looking forward to the future. You could leverage a variable in log search as a reference/lookup

David