Hello I am looking a simple SPL to  to detect activity from users without MFA in AWS. I have the search below which suggest I am getting some where. but just need to confirm if there is more to it    sourcetype=cloudtrail userIdentity.sessionContext.attributes.mfaAuthenticated=false ... View more