dataset="sonicwall_hunt"
| h1_ready="true"
| event_ms >= 1793516400000
| event_ms < 1794072600000
| kind="vpn_success" saml_enabled="true" expected_saml="true" auth_path="alternate_verified"
| select([event_ms,tenant_id,appliance_id,record_id,service_id,principal_id,session_key,source_ip,auth_path])
