Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who rated this post

Cyber Elite
Cyber Elite

You can't set a timeframe in reports, but you can set a schedule in a security rule

you could create a duplicate rule above your current rule, that is only active from (for example) 7pm-7am, and any other filters you'd want to add.

you can then create a custom report and use the query builder to filter for only that rulename



(( addr.src in <<IPAddressRange1>> ) and ( addr.src in <<IPAddressRange2>> ))  needs to have OR in between the subnets


your filter should look something like this:

(( addr.src in <<IPAddressRange1>> ) or ( addr.src in <<IPAddressRange2>> )) and (user.src in 'boarders') and (rule eq MyScheduledRule)

Tom Piens
PANgurus - SASE and Strata specialist; (co)managed services, VAR and consultancy

View solution in original post

Who rated this post