dataset="sonicwall_hunt"
| h3_ready="true"
| event_ms >= 1791480600000
| event_ms < 1794072600000
| kind="vpn_success" principal_id=* principal_id!="" principal_id!="-" source_ip=* source_ip!="" source_ip!="-"
| case { event_ms<1793516400000 | prior:=1; * | prior:=0; }
| case { event_ms>=1793516400000 saml_enabled="true" privileged="true" | recent_target:=1; * | recent_target:=0; }
| groupBy([tenant_id,appliance_id,principal_id,source_ip,session_key],function=[max(prior,as=prior),max(recent_target,as=recent_target),max(event_ms,as=last_ms)],limit=max)
| groupBy([tenant_id,appliance_id,principal_id,source_ip],function=[sum(prior,as=baseline_sessions),sum(recent_target,as=recent_sessions),max(last_ms,as=last_all_vpn_ms)],limit=max)
| baseline_sessions=0 recent_sessions>0
