cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Who rated this post

Cyber Elite
Cyber Elite

You can't set a timeframe in reports, but you can set a schedule in a security rule

you could create a duplicate rule above your current rule, that is only active from (for example) 7pm-7am, and any other filters you'd want to add.

you can then create a custom report and use the query builder to filter for only that rulename

 

FYI

(( addr.src in <<IPAddressRange1>> ) and ( addr.src in <<IPAddressRange2>> ))  needs to have OR in between the subnets

 

your filter should look something like this:

(( addr.src in <<IPAddressRange1>> ) or ( addr.src in <<IPAddressRange2>> )) and (user.src in 'boarders') and (rule eq MyScheduledRule)

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

Who rated this post