Alert Notification

I’m looking for a way to setup my Notification and/or Alerts for a specific time.
I Created a Stream Called:

Windows: User Successful Logon to Computer

The rules are:

Field EventID must match exactly 4624 (Successful login)
Field LogonType must match exactly 2 (A user logged on to this computer.)

This notifies me when any user/s logged into a Windows machine, from there I configure Event Definitions called:

User Has Logon Outside Business Hours

I’m trying to set it up to receive alerts from the hours of 5PM to 8 AM.
I don’t know if this is possible. I tried to create different field called user_time but it just gave me all the users logged in for the day.

My Environment:
CentOS 7 Latest Version
Graylog 3.1.1+b39ee32

Also, I looked through here. Maybe I missed something.

Any advice, Ideas or direction would be appreciated.
Thank you in advance.

Think I may have found my answer here;

Working on the Pipeline rule and cannot seem to get it to work.
I have stream called “Windows: User Successful Logon to Computer” so all users logging in gets dumped in that stream (24/7)
Then I created a pipeline rule for users logging in between 5 and 12 and “trying” to route it to a stream called “User Has Logon Outside Business Hours”.

I tried two different ways to make this happen. The first attempt I had one stage and one rule

My second attempt was to make two Stages and two Rules.

This is my first attempt to make Pipelines, any help would be apperciated, Thank you

I’m still trying, I think my rule is misconfigure but dont know what could be wrong.

rule “Between 5 and 12”
to_long(is_date($message.timestamp).hourOfDay) >= 5 &&
to_long(is_date($message.timestamp).hourOfDay) <= 12
set_field(“time_alert”, true);

rule “route to stream”

Any help or direction would be apperciated. Thanks

as Graylog runs the checks you use on UTC that might not work in your local timezone.

You need to adjust that:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.