String Operators
String operators allow you to compare string attributes or match patterns in both single-string and multi-value fields.
- Use the name of the operator (e.g.,
CONTAINS
) instead of symbolic syntax like~=
or^=
. - String values must be wrapped in double quotes and are case-sensitive. ("Confirmed active", "Critical", etc.).
- String operators are not case sensitive. You can use
CONTAINS
,Contains
, orcontains
for the same result.
CONTAINS
Use CONTAINS
to check if an attribute contains a specific substring. This operator uses a partial search.
FIND Asset AS a
WHERE a.name CONTAINS "brinqa"
The above query returns any assets with a name that contains the substring "brinqa".
NOT CONTAINS
Use NOT CONTAINS
to exclude records where the attribute includes the specified substring.
FIND Finding AS f
WHERE f.severity NOT CONTAINS "Low"
The above query returns findings with a severity that does not contains "Low".
LIKE
Use LIKE
to match string patterns using the asterisk (*
) as a wildcard. This is the only wildcard character supported in BQL. You can use the *
wildcard at the beginning, middle, or end of the string to perform partial matching. For additional information, see Wildcards.
FIND Asset AS a
WHERE a.displayName LIKE "Google*"
The above query returns assets with display names that start with "Google", such as "Google Workspace" or "Google Cloud".
NOT LIKE
Use NOT LIKE
to exclude records that match a specified wildcard pattern. Similar to the LIKE
operator, NOT LIKE
supports partial string matching using the asterisk (*) as a wildcard. For additional information, see Wildcards.
FIND Asset AS a
WHERE a.displayName NOT LIKE "Salesforce*"
The above query returns any assets whose display name do not start with "Salesforce".
STARTS WITH
Use STARTS WITH to match strings that begin with a specific substring.
FIND Asset AS a
WHERE a.name STARTS WITH "Zoom"
The above query returns assets whose names begin with "Zoom".
ENDS WITH
Use ENDS WITH
to find records where the attribute ends with a specific substring.
FIND Asset AS a
WHERE a.name ENDS WITH ".com"
The above query returns assets where the name ends with ".com".
NOT ENDS WITH
Use NOT ENDS WITH
to exclude results where the attribute ends with a specific substring.
FIND Asset AS a
WHERE a.name NOT ENDS WITH ".com"
The above query returns assets where the name does not end with ".com".