Help. It is necessary to make a rule that will work in a certain range of time

[Dimitry36]

Hello! 

It is necessary to make a rule that will work in a certain range of time. 

e.g. every day from 21:00 to 00:00 or from 21:00 to the next morning 06:00. 

I tried to do it through the transformation of time into a string, it did not work

The date looks like this:

EventTime [UTC]

2022-09-06T23:04:01Z

[#2]

@Dimitry36 What is the issue you are running into?   Using

todatetime('2022-09-06T23:04:01Z')

converts the string into the UTC time of '9/6/2022, 11:04:01.000 PM'

[#3]

I don't understand how to display an event at a specific time interval every day.
for example display events from 9:00 to 18:00, on this date every day

[#4 · Accepted solution]

@Dimitry36 You would need to do something like this to get the UTC equivalent of 0800 today

let dt = now();
print todatetime(strcat(datetime_part("month", dt),'/',datetime_part("day", dt),'/',datetime_part("year", dt), ' 08:00:00.000 AM'))

[#5]

WindowsEvent
| where EventID == 4663
| where EventData.AccessMask == 0x10000 or EventData.AccessList == "%%1537"
//| How do I need a time range? I want to see the events that take place for example 9 am to 18 pm.

[#6]

Please see: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-align-your-analytics-with-time... examples 9 & 10

[#7]

Thank you very much, 9 example fit perfectly.