You can't set a timeframe in reports, but you can set a schedule in a security rule
you could create a duplicate rule above your current rule, that is only active from (for example) 7pm-7am, and any other filters you'd want to add.
you can then create a custom report and use the query builder to filter for only that rulename
FYI
(( addr.src in <<IPAddressRange1>> ) and ( addr.src in <<IPAddressRange2>> )) needs to have OR in between the subnets
your filter should look something like this:
(( addr.src in <<IPAddressRange1>> ) or ( addr.src in <<IPAddressRange2>> )) and (user.src in 'boarders') and (rule eq MyScheduledRule)
Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
