Daily URL Filtering Report within a time frame

[SPS]

Hello,

I am trying to produce a report for our head of school accommodation that shows the URL filtering of his borders after a set time each day.

Producing the list in the URL filtering tab on the Palo Alto and downloading in CSV format is straightforward, but I would like to automate this process with a daily custom report of the night before.

Example of filter rule:
(( addr.src in <<IPAddressRange1>> ) and ( addr.src in <<IPAddressRange2>> )) and (user.src in 'boarders') and (receive_time geq '2022/03/03 22:00:00') and (receive_time leq '2022/03/03 23:59:59')

I am stuck in setting the time of the filter in the custom report query builder. It appears that I have to specify a date for ‘receive_time’ and can’t see any way around it. I have tried to see if there are any variables I can use, but no luck.

Any suggestions?

Thanks in advance,

Scott

[reaper · Accepted solution]

You can't set a timeframe in reports, but you can set a schedule in a security rule

you could create a duplicate rule above your current rule, that is only active from (for example) 7pm-7am, and any other filters you'd want to add.

you can then create a custom report and use the query builder to filter for only that rulename

FYI

(( addr.src in <<IPAddressRange1>> ) and ( addr.src in <<IPAddressRange2>> ))  needs to have OR in between the subnets

your filter should look something like this:

(( addr.src in <<IPAddressRange1>> ) or ( addr.src in <<IPAddressRange2>> )) and (user.src in 'boarders') and (rule eq MyScheduledRule)

[SPS]

@reaper Thank you, simple but effective.

Cheers,

Scott