SELECT agent_id
FROM endpoint_ip_mapping 
WHERE agent_local_ip IN (fw.destination_ip OR fw.nat_destination_ip)
AND start_time BETWEEN fw.event_time - INTERVAL '30 minutes'
AND fw.event_time + INTERVAL '30 minutes'