Watch scripts

Time-based condition examples

Write rules that use time functions on created_at.

These examples use native time functions such as hour_of_day(created_at) and day_of_week(created_at). Watch reads the timestamp from created_at on each transaction.

See Setting conditions for the full list of time functions and operators.

Late night transactions

This rule reviews larger transactions that occur late at night. It is useful for flagging activity that lands outside a customer’s normal operating window without blocking all after-hours traffic.

rule LateNightTransactions {
  description "Flags large transactions that occur late at night."

  when hour_of_day(created_at) >= 21
   and amount > 1000

  then review
       score   0.6
       reason  "Large transaction during late-night hours"
}

Review Christmas transactions

This rule reviews transactions that occur on Christmas Day. It is a simple seasonal pattern you can adapt for holidays, maintenance windows, or business-specific blackout periods.

rule ReviewChristmasTransactions {
  description "Flags transactions that occur on Christmas Day."

  when month_of_year(created_at) == 12
   and day_of_month(created_at) == 25

  then review
       score   0.6
       reason  "Transaction occurred on Christmas Day"
}

Unusual transaction time

This rule reviews large transactions that happen in the early-morning window between 1 AM and 5 AM. It is a good template when you want to tune thresholds based on hours that are uncommon for a customer segment or product line.

rule UnusualTransactionTime {
  description "Flags large transactions during unusual early-morning hours."

  when hour_of_day(created_at) >= 1
   and hour_of_day(created_at) < 5
   and amount > 1000

  then review
       score   0.6
       reason  "Large transaction during unusual early-morning hours"
}

Weekend transaction check

This rule reviews large transactions that occur on a weekend. It is a practical pattern for products where genuine activity is mostly weekday-driven and weekend spikes deserve a closer look.

rule WeekendTransactionCheck {
  description "Flags large transactions that occur on weekends."

  when day_of_week(created_at) in (0, 6)
   and amount > 5000

  then review
       score   0.4
       reason  "Large weekend transaction flagged for review"
}