Hi,

I’m trying to create a Chronicle rule that identifies when the total number of error responses (400 or 500) across my environment is significantly higher than the number of successful responses (200) within a one-week period.

Specifically, I want to trigger a detection if the total number of 400/500 responses during the week is at least twice the number of 200 responses — not necessarily from the same IP address.

Is it possible to implement this kind of comparison between two response code groups in a single Chronicle rule, and how would you implement this?

Also, is it necessarily possible to write Chronicle rules that check over a one-week time window, or are rules limited to 24-hour periods?

Thank you!