Updated time and weekday options in the rules syntax

wazuh · Oct 21, 2024 · ad26e48 · ad26e48
1 parent e383b06
commit ad26e48
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/source/user-manual/ruleset/ruleset-xml-syntax/rules.rst b/source/user-manual/ruleset/ruleset-xml-syntax/rules.rst
@@ -957,6 +957,11 @@ Example:
 
 This rule will trigger when there is a successful login between 6 pm and 8 am.
 
+.. note::
+
+   The `time` used for matching the rule is based on the local machine's time, not the timestamp of the event itself. 
+   Ensure that the local time settings are correctly configured to avoid unexpected rule triggers.
+
 weekday
 ^^^^^^^
 
@@ -982,6 +987,11 @@ Example:
 
 This rule will trigger when there is a successful login during the weekend.
 
+.. note::
+
+   The `weekday` used for matching the rule is based on the local machine's time, not the timestamp of the event itself. 
+   Ensure that the local time settings are correctly configured to avoid unexpected rule triggers.
+
 .. _rules_id:
 
 id