Enabling and Disabling Views

[RSAAdmin]

Have you ever wanted to have an alert view only active for a certain period of time?  for example only after business hours.  Using the following script you could schedule a task to turn on a view after work hours then disable the view when the work day starts.

[RSAAdmin]

Very interesting...I may need to play around with this a little more.  I have been trying to do something similar, but have been trying to do it to activate/deactivate watchlists in a correlation rule based on timeframe.  This could probably work for me if I have multiple copies of the views, though, eh?

[RSAAdmin]

Very nice Dave.

Elegant and simple.

Mark Nadir