String Operators

String operators allow you to compare string attributes or match patterns in both single-string and multi-value fields.

note

• Use the name of the operator (e.g., CONTAINS) instead of symbolic syntax like ~= or ^=.
• String values must be wrapped in double quotes and are case-sensitive. ("Confirmed active", "Critical", etc.).
• String operators are not case-sensitive. You can use CONTAINS, Contains, or contains for the same result.

CONTAINS

Use CONTAINS to check if an attribute contains a specific substring. This operator uses a partial search.

FIND Asset AS a
WHERE a.name CONTAINS "brinqa"

The above query returns any assets with a name that contains the substring "brinqa".

NOT CONTAINS

Use NOT CONTAINS to exclude records where the attribute includes the specified substring.

FIND Finding AS f
WHERE f.severity NOT CONTAINS "Low"

The above query returns findings with a severity that does not contains "Low".

LIKE

Use LIKE to match string patterns using the asterisk (*) as a wildcard. This is the only wildcard character supported in BQL. You can use the * wildcard at the beginning, middle, or end of the string to perform partial matching. For additional information, see Wildcards.

FIND Asset AS a
WHERE a.displayName LIKE "Google*"

The above query returns assets with display names that start with "Google", such as "Google Workspace" or "Google Cloud".

NOT LIKE

Use NOT LIKE to exclude records that match a specified wildcard pattern. Similar to the LIKE operator, NOT LIKE supports partial string matching using the asterisk (*) as a wildcard. For additional information, see Wildcards.

FIND Asset AS a
WHERE a.displayName NOT LIKE "Salesforce*"

The above query returns any assets whose display name do not start with "Salesforce".

STARTS WITH

Use STARTS WITH to match strings that begin with a specific substring.

FIND Asset AS a
WHERE a.name STARTS WITH "Zoom"

The above query returns assets whose names begin with "Zoom".

ENDS WITH

Use ENDS WITH to find records where the attribute ends with a specific substring.

FIND Asset AS a
WHERE a.name ENDS WITH ".com"

The above query returns assets where the name ends with ".com".

NOT ENDS WITH

Use NOT ENDS WITH to exclude results where the attribute ends with a specific substring.

FIND Asset AS a
WHERE a.name NOT ENDS WITH ".com"

The above query returns assets where the name does not end with ".com".