Query specific day time range

InsightIDR
1

Hello there

I would like to ask whether there is a way to create query with filter for specific day time range ?
Use case
Show asset authentication or file access out of working hours.
Like admin is connection to system between 9:00pm and 6:00am.

Thanks

Peter

2

Hello Peter,

You could use a query such as this below to find all authentication attempts outside certain hours of the day:

where(timestamp!=/.*T(07|08|09|10|11|12|13|14|15|16|17|18|19|20).*/)

This may need some tuning to fit your specific use case but I believe it’s a good starting point. Let me know if you have any trouble with it.

Tony

3

Great. Tony, thank you very much. We will try.