topic Re: Rules Time Zones in Splunk Enterprise Security

Rules Time Zones

astatrial — Thu, 18 Feb 2021 12:27:00 GMT

Hi All,

I need to build a rule that alerts for specific activity by specific user past working hours.

For example:

I want to alert when user "Dani" logs in to the computer not between 7:00 - 18:00.

The problem is that the user is not in the same time zone as me.

So login logs at 19:00 in my time zone can be actually at 14:00 in the other user time zone.

- Does anyone know what is the time zone that the rules go by?

- Is it set by the configuration of the user that the rule is running as?

Thanks !

richgalloway — Thu, 18 Feb 2021 13:45:37 GMT

Yes, the rules use the time zone of the user running the rule.

astatrial — Thu, 18 Feb 2021 14:15:22 GMT

Thanks for the fast reply.

If the time zone of the user is changed? Does it also changed for the rules?

richgalloway — Thu, 18 Feb 2021 14:58:51 GMT

Yes