SonicWallHunt_CL
| where event_ms >= 1791480600000 and event_ms < 1794072600000
| where h3_ready=="true"
| where kind=="vpn_success" and isnotempty(principal_id) and principal_id!="-" and isnotempty(source_ip) and source_ip!="-"
| extend prior=iff(event_ms<1793516400000,1,0),recent_target=iff(event_ms>=1793516400000 and saml_enabled=="true" and privileged=="true",1,0)
| summarize prior=max(prior),recent_target=max(recent_target),last_ms=max(event_ms) by tenant_id,appliance_id,principal_id,source_ip,session_key
| summarize baseline_sessions=sum(prior),recent_sessions=sum(recent_target),last_all_vpn_ms=max(last_ms) by tenant_id,appliance_id,principal_id,source_ip
| where baseline_sessions==0 and recent_sessions>0
