//CW - HUNT FOR OUT OF HOURS REMOTE ACCESS
FILTERING_GROUP_NAME= "WebProxy_Partners"
| R_PORT = 3389 OR ACTION=RBI
| time:hour(as=hour, field=@timestamp)
| time:dayOfWeek(as=dow, field=@timestamp)
| isWeekday:=if(in(dow, values=[1,2,3,4,5]), then=true, else=false) //determines whether the parsed date is a weekday or not
| isOutofHours:=if(in(hour, values=[19,20,21,22,23,0,1,2,3,4,5,6]), then=true, else=false)
| (isWeekday=true and isOutofHours=true) OR //WEEKDAYS OUT OF HOURS
  (isWeekday=false) //ANYTIME ON WEEKENDS