Day/week/Time based Analytical (scheduled) rule in Azure Sentinel

Question

&nbsp;Hi Community,&nbsp;I am currently working with a client on a certain requirement for detection of an office 365 message activity based on time and date. below business use case in detail&nbsp;Use case: emails sent to external domainafter office hours in working days (i.e. between 5:00 PM to 9:00 AM) andsame activity any time on non-working days (i.e. any time on Saturdays and Sundays)&nbsp;For the first use case, I have created KQL for detection based on Time hours and it is working but&nbsp; the rule runs only on certain time during the weekend because I need the rule to detect activities anytime on weekend, below query for reference&nbsp;O365MessageTrace_CL|&nbsp;where&nbsp;RecipientAddress_s&nbsp;!contains&nbsp;"m365x971587.onmicrosoft.com"|&nbsp;extend&nbsp;ReceivedTimeStamp&nbsp;=&nbsp;tostring(format_datetime(Received_t,&nbsp;"HH"))|&nbsp;where&nbsp;ReceivedTimeStamp&nbsp;in&nbsp;("17",&nbsp;"18",&nbsp;"19",&nbsp;"20",&nbsp;"21",&nbsp;"22",&nbsp;"23",&nbsp;"00",&nbsp;"01",&nbsp;"02",&nbsp;"03",&nbsp;"04",&nbsp;"05",&nbsp;"06",&nbsp;"07",&nbsp;"08")|&nbsp;project&nbsp;Received_t,&nbsp;ReceivedTimeStamp,&nbsp;SenderAddress_s,&nbsp;RecipientAddress_s,&nbsp;Subject_s,&nbsp;Status_s,&nbsp;MessageTraceId_g|&nbsp;extend&nbsp;AccountCustomEntity&nbsp;=&nbsp;SenderAddress_s&nbsp;Require Help on:running the first rule only on weekdays (M,T,W,T,F) so that it detects activity between certain timeframe as mentioned in KQL.scheduling the second rule to run only on weekend irrespective of timeframe&nbsp;P.S: i used logic app's recurrence based on date and time but logic app doesn't supportenabling/disabling a sentinel rule

user9864 · Answer

CliveWatson&nbsp;We defined a set of workspaces function for it.for example&nbsp;&nbsp;let _get_day_name = (timestamp:datetime){tostring(dynamic(["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"])[toint(dayofweek(timestamp)/1d)]) }
;
let _is_working_hours = (TimeGenerated: datetime, is_local_time:bool = false, timezone:string){
                                    let local_time = iif(is_local_time
                                                        , TimeGenerated
                                                        , datetime_utc_to_local(TimeGenerated, timezone)
                                                        )
                                    ;
                                    get_day_name(local_time) !in("Sat", "Sun")
                                    and hourofday(local_time) between (8 .. 18)
                                                }
;&nbsp;&nbsp;

garybushey · Answer

KrishhnaM&nbsp;You could use a dayofweek&nbsp;function to determine if it is a weekend or not and then and iif&nbsp;statement to handle different hour of the day processing.

clivewatson · Answer

Some examples: https://techcommunity.microsoft.com/t5/azure-sentinel/how-to-align-your-analytics-with-time-windows-in-azure-sentinel/ba-p/1667574

Forum Discussion

Day/week/Time based Analytical (scheduled) rule in Azure Sentinel

3 Replies