let IdP = SonicWallHunt_CL
| where event_ms >= 1793516100000 and event_ms < 1794072600000
| where h2_ready=="true"
| where kind=="idp_saml_success"
| project join_key,rhs_idp_ms=event_ms;
SonicWallHunt_CL
| where event_ms >= 1793516400000 and event_ms < 1794072300000
| where h2_ready=="true"
| where kind=="vpn_success" and saml_enabled=="true"
| where isnotempty(join_key) and join_key!="-" and isnotempty(session_key) and session_key!="-"
| project join_key,tenant_id,appliance_id,record_id,principal_id,service_id,session_key,event_ms
| join kind=leftouter IdP on join_key
| summarize idp_matches=countif(isnotnull(rhs_idp_ms) and rhs_idp_ms>=event_ms-300000 and rhs_idp_ms<=event_ms+300000) by tenant_id,appliance_id,record_id,principal_id,service_id,session_key,event_ms
| where idp_matches==0
