FROM sonicwall-hunt
| WHERE event_ms >= 1793516400000 AND event_ms < 1794072300000
| WHERE h2_ready=="true"
| WHERE kind=="vpn_success" AND saml_enabled=="true" AND join_key IS NOT NULL AND join_key!="" AND join_key!="-" AND session_key IS NOT NULL AND session_key!="" AND session_key!="-"
| KEEP join_key,tenant_id,appliance_id,record_id,principal_id,service_id,session_key,event_ms
| LOOKUP JOIN sonicwall-idp-lookup ON join_key
| EVAL idp_hit=CASE(rhs_idp_ms IS NOT NULL AND rhs_idp_ms>=event_ms-300000 AND rhs_idp_ms<=event_ms+300000,1,0)
| STATS idp_matches=MAX(idp_hit) BY tenant_id,appliance_id,record_id,principal_id,service_id,session_key,event_ms
| WHERE idp_matches==0
| LIMIT 10000
