FROM sonicwall-hunt
| WHERE event_ms >= 1793516400000 AND event_ms < 1794072600000
| WHERE h1_ready=="true"
| WHERE kind=="vpn_success" AND saml_enabled=="true" AND expected_saml=="true" AND auth_path=="alternate_verified"
| KEEP event_ms,tenant_id,appliance_id,record_id,service_id,principal_id,session_key,source_ip,auth_path
| LIMIT 10000
