index=sonicwall_hunt earliest=0 latest=now
| where event_ms >= 1793516400000 AND event_ms < 1794072600000
| eval process_name=lower(process_name)
| where h4_ready="true"
| where kind="endpoint_admin_logon" OR (kind="endpoint_process" AND in(process_name,"powershell.exe","pwsh.exe","cmd.exe","wmic.exe","winrs.exe","mstsc.exe","psexec.exe"))
| where isnotnull(session_key) AND session_key!="" AND session_key!="-"
| fields session_key event_ms tenant_id principal_id endpoint_id kind process_name parent_name command_line record_id
| join type=inner max=0 session_key [
    index=sonicwall_hunt earliest=0 latest=now
    | where event_ms >= 1793516400000 AND event_ms < 1794072600000
    | search h4_ready="true" kind="vpn_success" saml_enabled="true" expected_saml="true" auth_path="alternate_verified"
    | fields session_key event_ms principal_id
    | rename event_ms AS rhs_vpn_ms principal_id AS rhs_vpn_principal
    | fields session_key rhs_vpn_ms rhs_vpn_principal
  ]
| where event_ms>=rhs_vpn_ms AND event_ms<=rhs_vpn_ms+3600000
| table event_ms tenant_id session_key rhs_vpn_ms rhs_vpn_principal principal_id endpoint_id kind process_name parent_name command_line record_id
