Time based alerts

[tor]

Description of your problem

How can I create a alert and notification if someone logs into a sever outside normal office hours. 9am to 6.30pm normal hours. If out side these hours someone try to login then an alert is generated with a email notification.

So time based alerts.

Operating system information

• CentOS 7.9

Package versions

• Graylog 4.1.2

[gsmith]

Hello,
I think your referring to this? You may need to adjust the configurations to your needs.

User logged in Outside Business Hours

I have to give respect to @jan for showing me this. This became the most importent Pipeline we use in multiply environments. rule "Between 6 PM and 6 AM" when ( to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) >= 0 AND to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) <= 6 ) OR ( to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) >= 18 AND to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) <= 0 ) then set_field("trigger_workh…

[tor]

Yes that is what I’m looking for. How do I find out the time zone style that graylog accepts. So I’m UK london.

Is this a pipeline rule that I can import?

[gsmith]

@tor

How do I find out the time zone style that graylog accepts

Next time you can always look in your Graylog “server.conf” file here

The link inside your configuration file will lead you here.

https://www.joda.org/joda-time/timezones.html

Edit:

@tor

@tor

Is this a pipeline rule that I can import?

Example:

• Create a stream called “Windows: User Successful Logon Local”.

• Create Pipeline and attach it to stream “Windows: User Successful Logon Local”.

• Create the rules and set the stages.

You may have to adjust these steps to your needs.