Advanced EPL Rule trigger only if it matches the event_time range passed

[danielfortes]

Hello,

I'm working currently on a rule that should trigger some conditions (it's fully working) only if the event time matches some interval. So in a simple way, the alert should be triggered only if the time of the event was between 10pm-07am.

I worked with the EPL Essentials documentation where you can find two ways about Time-Based Contexts but any of those technics are working.

NetWitness version: 11.6.1.0

My rule, fully working and without any filter for time range/interval of time as I need is:

@RSAAlert(oneInSeconds=0)
@RSAPersist

SELECT * FROM Event(
    (reference_id IS NOT NULL AND `group` IS NOT NULL)
    AND
    (reference_id IN ('4728' , '4732' , '4756' , '4785' , '4787') OR reference_id IN ( '4729' , '4733' , '4757' , '4786' , '4788'))
);

Is there any way to filter all of the content (I'm receiving already) by event_time or time?

References I tried already to filter the results by time interval:

1st way: CONTEXT

create context BizHours start (0, 9, *, *, *) end (0, 17, *, *, *);
context BizHours
select * from Event(<ANY CONDITIONS HERE>);

----------------------------------------

2nd way: PATTERNS

create variable string var_on_off;
on pattern[Every(timer:at(*, 9, *, *, *))] set var_on_off = 'true';
on pattern[Every(timer:at(*, 17, *, *, *))] set var_on_off =
'false';
select * from Event(var_on_off='true' AND <ANY CONDITIONS HERE>)

[YOANNTHIBERT · Accepted solution]

SELECT * FROM Event (
(reference_id IS NOT NULL AND `group` IS NOT NULL)
AND
(reference_id IN ('4728' , '4732' , '4756' , '4785' , '4787') OR reference_id IN ( '4729' , '4733' , '4757' , '4786' , '4788')
AND (
/* Horaire en semaine */
((current_timestamp.getHourOfDay+2) NOT IN (8,9,10,11,12,13,14,15,16,17,18)
AND current_timestamp.getDayOfWeek IN (2,3,4,5,6))
/* Horaire weekend */
OR current_timestamp.getDayOfWeek IN (1,7))
).win:time_batch(120 seconds)
GROUP BY ip_src, user_dst HAVING COUNT(*) >=4;

[danielfortes]

Thanks for your help.

The idea of using (current_timestamp.getHourOfDay+2) NOT IN (8,9,10,11,12,13,14,15,16,17,18) was really nice.

Something I've not seen in the official doc