FROM sonicwall-hunt
| WHERE event_ms >= 1793516400000 AND event_ms < 1794072600000
| EVAL process_name=TO_LOWER(process_name)
| WHERE h4_ready=="true"
| WHERE kind=="endpoint_admin_logon" OR (kind=="endpoint_process" AND process_name IN ("powershell.exe","pwsh.exe","cmd.exe","wmic.exe","winrs.exe","mstsc.exe","psexec.exe"))
| WHERE session_key IS NOT NULL AND session_key!="" AND session_key!="-"
| KEEP session_key,event_ms,tenant_id,principal_id,endpoint_id,kind,process_name,parent_name,command_line,record_id
| LOOKUP JOIN sonicwall-session-lookup ON session_key
| WHERE rhs_vpn_saml_enabled=="true" AND rhs_vpn_expected_saml=="true" AND rhs_vpn_auth_path=="alternate_verified" AND rhs_vpn_ms>=1793516400000 AND rhs_vpn_ms<1794072600000
| WHERE event_ms>=rhs_vpn_ms AND event_ms<=rhs_vpn_ms+3600000
| KEEP event_ms,tenant_id,session_key,rhs_vpn_ms,rhs_vpn_principal,principal_id,endpoint_id,kind,process_name,parent_name,command_line,record_id
| LIMIT 10000
