index=sonicwall_hunt earliest=0 latest=now
| where event_ms >= 1791480600000 AND event_ms < 1794072600000
| search h3_ready="true" kind="vpn_success"
| where isnotnull(principal_id) AND principal_id!="" AND principal_id!="-" AND isnotnull(source_ip) AND source_ip!="" AND source_ip!="-"
| eval prior=if(event_ms<1793516400000,1,0), recent_target=if(event_ms>=1793516400000 AND saml_enabled="true" AND privileged="true",1,0)
| stats max(prior) AS prior max(recent_target) AS recent_target max(event_ms) AS last_ms BY tenant_id appliance_id principal_id source_ip session_key
| stats sum(prior) AS baseline_sessions sum(recent_target) AS recent_sessions max(last_ms) AS last_all_vpn_ms BY tenant_id appliance_id principal_id source_ip
| where baseline_sessions=0 AND recent_sessions>0
