Thank you. I did see that, but the syntax was an issue. Looks like weekday is the other one I need. Thanks for the link. I searched the site and nothing was coming up.
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of dan (ddp) Sent: Monday, August 13, 2012 9:13 AM To: [email protected] Subject: Re: [ossec-list] Ignoring alerts at certain times of the day On Mon, Aug 13, 2012 at 9:55 AM, Nelson, James <[email protected]> wrote: > How would I write a custom rule to set the level of certain rules to 0 > during a specific time of day. For example, I want to ignore logins > on a machine during office hours. > > > > Thanks You could try http://www.ossec.net/doc/syntax/head_rules.html#element-time
