We "missed" (obviously the untagged data is still there) what appears to be a highly focused SonicWall SSL VPN credential event back in September. Two distinct ja4t (65495_2-4-8-1-3_65495_7 && 33280_2-4-8-1-3_65495_7). IPs in alt txt. We'll get a tag/detection crafted.