index=sonicwall_hunt earliest=0 latest=now
| where event_ms >= 1793516400000 AND event_ms < 1794072600000
| search h1_ready="true" kind="vpn_success" saml_enabled="true" expected_saml="true" auth_path="alternate_verified"
| table event_ms tenant_id appliance_id record_id service_id principal_id session_key source_ip auth_path
