Copy and paste into SIEM Search Bar
SELECT new_logs.uuid, new_logs.organization_id, new_logs.event_code_string AS ecs_event_code, new_logs.event_action AS event_action, new_logs.user_name AS user_name, new_logs.source_ip AS source_ip, new_logs.ecs_fields['sonicwall.msg'] AS ecs_sonicwall_msg, new_logs.message FROM new_logs AS logs WHERE new_logs.organization_id = 669808 AND new_logs.account_id = 60103 AND new_logs.uuid >= '019f89aa-30a0-7000-8000-000000000000' AND new_logs.uuid < '019f8a85-eaa0-7000-8000-000000000000' AND new_logs.event_provider = 'Syslog-SonicWall' AND new_logs.message ILIKE '%SSLVPN%' ORDER BY new_logs.uuid DESC LIMIT 100