Event Trigger time in Correlation rule

[RSAAdmin]

Dear All, Please help me in writing a correlation rule to trigger the alert if some event happens between certime timeframe , say between 10PM to 4AM. How can I configure the time frame in correlation rule? Thanks, MAK.

[RSAAdmin]

Unfortunately within correlation rules you don't have great functionality over time ranges. You will have to run scheduled jobs to start the view at 10:00 and stop the view at 16:00.

I have attached two .bat files which can start and stop your view by editing one line in the code. Set these up as scheduled tasks and change INSERT VIEW NAME HERE to your view name, i.e. - Failed Login

Hope this helps,

Lee

[RSAAdmin]

And the other...