SPL Bug: AWS ECR Container Upload Outside Business Hours #2423

The current logic for this rule has this criteria

date_hour>=20 OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) 

which means that it will detect uploads between Monday and Friday between midnight and 8am and 8pm to midnight.

It also means that it will never trigger on uploads done during Saturday or Sunday at any time.

I believe the logic should be

date_hour>=20 OR date_hour<8 OR date_wday=saturday OR date_wday=sunday