FROM sonicwall-hunt
| WHERE event_ms >= 1791480600000 AND event_ms < 1794072600000
| WHERE h3_ready=="true"
| WHERE kind=="vpn_success" AND principal_id IS NOT NULL AND principal_id!="" AND principal_id!="-" AND source_ip IS NOT NULL AND source_ip!="" AND source_ip!="-"
| EVAL prior=CASE(event_ms<1793516400000,1,0), recent_target=CASE(event_ms>=1793516400000 AND saml_enabled=="true" AND privileged=="true",1,0)
| STATS prior=MAX(prior),recent_target=MAX(recent_target),last_ms=MAX(event_ms) BY tenant_id,appliance_id,principal_id,source_ip,session_key
| STATS baseline_sessions=SUM(prior),recent_sessions=SUM(recent_target),last_all_vpn_ms=MAX(last_ms) BY tenant_id,appliance_id,principal_id,source_ip
| WHERE baseline_sessions==0 AND recent_sessions>0
| LIMIT 10000
