Splunk Enterprise Security

Rules Time Zones

astatrial
Contributor

Hi All,

I need to build a rule that alerts for specific activity by specific user past working hours.

For example:

I want to alert when user "Dani" logs in to the computer not between 7:00 - 18:00.

The problem is that the user is not in the same time zone as me.

So login logs at 19:00 in my time zone can be actually at 14:00 in the other user time zone.

-  Does anyone know what is the time zone that the rules go by?

-  Is it set by the configuration of the user that the rule is running as? 

 

Thanks ! 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, the rules use the time zone of the user running the rule.

---
If this reply helps you, Karma would be appreciated.
0 Karma

astatrial
Contributor

Thanks for the fast reply.

 

If the time zone of the user is changed? Does it also changed for the rules?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...