SonicWallHunt_CL
| where event_ms >= 1793516400000 and event_ms < 1794072600000
| where h1_ready=="true"
| where kind=="vpn_success" and saml_enabled=="true" and expected_saml=="true" and auth_path=="alternate_verified"
| project event_ms,tenant_id,appliance_id,record_id,service_id,principal_id,session_key,source_ip,auth_path
