Detect events out of office hours - time/date

Graylog Central (peer support)
1

Hi

I need a little guidance on how to detect logon events outside of office hours.

For this i’m guessing i need to:

  • Create a stream to find the correct event (logon events)
  • Then some pipeline rule(s) to check the time of day and add a field ‘OutOfficeHours’ true/false

Does that sound like the best way? Would you do it any other way?
I’m struggling to find any good examples of using time and date online…

I’d highly appreciate any help, thanks

2

Hi

My first idea was the pipeline when i read the topic. But I’m not a pro, so it can be some other way too.
Try it out. At pipelines a lot of date convert/parse functions what you can use this case.
And maybe another level to use csv lookup table to handle the special days (like national holidays, xmas, etc)

M

3

maybe this rule can help you a little with that:

rule "Between 0 and 6 o'clock"
when
  to_date($message.timestamp).hourOfDay >= 0 && 
  to_date($message.timestamp).hourOfDay <= 6
then
  set_field("trigger_alert", true);
end

Taken from my Deep Dive into Processing Pipelines.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.