Skip to main content

String Operators

String operators allow you to compare string attributes or match patterns in both single-string and multi-value fields.

note
  • Use the name of the operator (e.g., CONTAINS) instead of symbolic syntax like ~= or ^=.
  • String values must be wrapped in double quotes and are case-sensitive. ("Confirmed active", "Critical", etc.).
  • String operators are not case sensitive. You can use CONTAINS, Contains, or contains for the same result.

CONTAINS​

Use CONTAINS to check if an attribute contains a specific substring. This operator uses a partial search.

FIND Asset AS a
WHERE a.name CONTAINS "brinqa"

The above query returns any assets with a name that contains the substring "brinqa".

NOT CONTAINS​

Use NOT CONTAINS to exclude records where the attribute includes the specified substring.

FIND Finding AS f
WHERE f.severity NOT CONTAINS "Low"

The above query returns findings with a severity that does not contains "Low".

LIKE​

Use LIKE to match string patterns using wildcards (*). This operator allows for partial string matching.

FIND Asset AS a
WHERE a.displayName LIKE "Google*"

The above query returns assets with display names that start with "Google", such as "Google Workspace" or "Google Cloud".

For additional information and an interactive tool on how wildcard characters work, see SQL Wildcards.

NOT LIKE​

Use NOT LIKE to exclude records that match a specified wildcard pattern. This operator allows for partial string matching.

FIND Asset AS a
WHERE a.displayName NOT LIKE "Salesforce*"

The above query returns any assets whose display name do not start with "Salesforce".

For additional information and an interactive tool on how wildcard characters work, see SQL Wildcards.

STARTS WITH​

Use STARTS WITH to match strings that begin with a specific substring.

FIND Asset AS a
WHERE a.name STARTS WITH "Zoom"

The above query returns assets whose names begin with "Zoom".

ENDS WITH​

Use ENDS WITH to find records where the attribute ends with a specific substring.

FIND Asset AS a
WHERE a.name ENDS WITH ".com"

The above query returns assets where the name ends with ".com".

NOT ENDS WITH​

Use NOT ENDS WITH to exclude results where the attribute ends with a specific substring.

FIND Asset AS a
WHERE a.name NOT ENDS WITH ".com"

The above query returns assets where the name does not end with ".com".

Last updated on