There are two functions you can use to create dates via your own input. 

The output of this is an integer. This allows you to use math operators to compare the event_timestamp.seconds to the converted int above.

Any date prior to the January 15th 2025 timestamp will be a lesser value.

Here are a few accompanying blogs that might help based on the syntax links that @alube shared above. The timestamp.diff function also will give you an integer output based on the time unit specified so I provided that option as well. Mathematical operations to calculate the difference between two time values within the outcome section is also another method.

https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-What-Difference-Does-It-Make/ba-p/832247

https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Time-Time-Time-See-What-s-Become-of-Me/ba-p/813704

Thank you for the helpful information. However, I encountered an issue while using timestamp.diff in our tenant.

I received the following exception:

I tried using timestamp.diff in various sections of the rule, but the outcome remained the same.

Is timestamp.diff a recent addition? I couldn’t find it mentioned in the Yara-L syntax documentation:

https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax

it is a fairly recent addition and it is possible it may not be turned on within your tenant yet. You may be able to request it by opening a ticket to request it.