Event Definition Summary

[gsmith]

Hello

@turb0snail

could you please elaborate your pipeline section, as you can see in my pipeline there are two of them

Yes, you can find it here…

User logged in Outside Business Hours

I have to give respect to @jan for showing me this. This became the most importent Pipeline we use in multiply environments. rule "Between 6 PM and 6 AM" when ( to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) >= 0 AND to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) <= 6 ) OR ( to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) >= 18 AND to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) <= 0 ) then set_field("trigger_workh…

The reason I have route_to_stream is for my event definition. while back I had some white noise so I decided to configured it this way. Soon as the logs hit this stream I can fine tune my Search within the last
Example:

What I tried to do is make it Simple, Accurate, and Reliable.