The following TQL query is for Juniper VPN evidence.Identify VPN logins grouped by username and source IP addressclass:juniper_vpn msg:login* | groupby [username,srcisp]