Time Operations Using Analytics Rule Syntax

Retrieve the time of day, day of the week, or day of the month using analytics rule syntax.

All time operations operate in Coordinated Universal Time (UTC). Time zones are not supported.

Function	Description	Returned Value	Examples
`timeofday()`	Evaluates the time of day of the event time as hours after midnight, including fractions.	Double	If the event occurred at 2:00:00 PM UTC, `timeofday()` returns 14. If the event occurred at 11:05:25 AM UTC, `timeofday()` returns 11.090277777777779. To trigger an analytics rule when an event occurs outside business hours, from 18:00:00 to 17:59:59 UTC, set `featureValue` to `"if(!startsWithAny(toString(timeofday()),'8.','9.','10.','11.','12.','13.', '14.', '15.', '16.', '17.'),timeofday(),'')"` If an event time does not occur betwee*on outputs an empty string.
`timeofweek()`	Evaluates the day of the week of the event time as a number between 0 and 6, including fractions: 0 – Sunday 1 – Monday 2 – Tuesday 3 – Wednesday 4 – Thursday 5 – Friday 6 – Saturday	Double	If the event occurred on Wednesday at 12:00:00 PM UTC, `timeofweek()` returns 3.5. If the event occurred on Monday at 11:05:25 AM UTC, `timeofweek()` returns 1.4620949074074074. To trigger an analytics rule on Mondays, set `featureValue` to `startsWith(toString(timeofweek()),'1.')`.
`timeofmonth()`	Evaluates the day of the month of the event time as a number between 0 and 30, including fractions.	Double	If the event occurred on August 10 at 4:00:00 PM UTC, `timeofmonth()` returns 10.6666666667. If the event occurred on July 20 at 11:05:25 AM UTC, `timeofmonth()` returns 19.46209490740741

Threat Detection ManagementThreat Detection Management Guide