dataset="sonicwall_hunt"
| h4_ready="true"
| event_ms >= 1793516400000
| event_ms < 1794072600000
| kind="endpoint_admin_logon" OR (kind="endpoint_process" AND (process_name="powershell.exe" OR process_name="pwsh.exe" OR process_name="cmd.exe" OR process_name="wmic.exe" OR process_name="winrs.exe" OR process_name="mstsc.exe" OR process_name="psexec.exe"))
| session_key=* session_key!="" session_key!="-"
| select([@timestamp,session_key,event_ms,tenant_id,principal_id,endpoint_id,kind,process_name,parent_name,command_line,record_id])
| join(query={
    dataset="sonicwall_hunt" h4_ready="true" kind="vpn_success" saml_enabled="true" expected_saml="true" auth_path="alternate_verified"
    | event_ms >= 1793516400000
    | event_ms < 1794072600000
    | select([@timestamp,session_key,event_ms,principal_id])
    | rhs_vpn_ms:=event_ms
    | rhs_vpn_principal:=principal_id
  },field=session_key,include=[rhs_vpn_ms,rhs_vpn_principal],mode=inner,max=200000,limit=200000,
    start="1793516400000",end="1794072600000")
| delta_ms:=event_ms-rhs_vpn_ms
| delta_ms>=0
| delta_ms<=3600000
| select([event_ms,tenant_id,session_key,rhs_vpn_ms,rhs_vpn_principal,principal_id,endpoint_id,kind,process_name,parent_name,command_line,record_id])
