V2.0.0 Meta-rule Time Selection

[frack113]

Time Selection Specificication

Time Selection

Attribute: timespan

defines a time period in which the correlation should be applied.
The following format must be used: number + letter (in lowercase)

• Xs seconds
• Xm minutes
• Xh hours
• Xd days

---

There's no limit to the specifications you can use to stay as open as possible.
It's up to you to define them according to your environment.

To have1h30 you have to write timespan: 90m .
Is it necessary to introduce timespan: 1h30 ?

[thomaspatzke]

I wouldn't make it too complicated and restrict it to an single definition like 90m. It keeps it simple to parse a rule.