Skip to main content

String Operators

String operators allow you to compare string attributes or match patterns in both single-string and multi-value fields.

note
  • Use the name of the operator (e.g., CONTAINS) instead of symbolic syntax like ~= or ^=.
  • String values must be wrapped in double quotes and are case-sensitive. ("Confirmed active", "Critical", etc.).
  • String operators are not case sensitive. You can use CONTAINS, Contains, or contains for the same result.

CONTAINS​

Use CONTAINS to check if an attribute contains a specific substring. This operator uses a partial search.

FIND Asset AS a
WHERE a.name CONTAINS "brinqa"

The above query returns any assets with a name that contains the substring "brinqa".

NOT CONTAINS​

Use NOT CONTAINS to exclude records where the attribute includes the specified substring.

FIND Finding AS f
WHERE f.severity NOT CONTAINS "Low"

The above query returns findings with a severity that does not contains "Low".

LIKE​

Use LIKE to match string patterns using the asterisk (*) as a wildcard. This is the only wildcard character supported in BQL. You can use the * wildcard at the beginning, middle, or end of the string to perform partial matching. For additional information, see Wildcards.

FIND Asset AS a
WHERE a.displayName LIKE "Google*"

The above query returns assets with display names that start with "Google", such as "Google Workspace" or "Google Cloud".

NOT LIKE​

Use NOT LIKE to exclude records that match a specified wildcard pattern. Similar to the LIKE operator, NOT LIKE supports partial string matching using the asterisk (*) as a wildcard. For additional information, see Wildcards.

FIND Asset AS a
WHERE a.displayName NOT LIKE "Salesforce*"

The above query returns any assets whose display name do not start with "Salesforce".

STARTS WITH​

Use STARTS WITH to match strings that begin with a specific substring.

FIND Asset AS a
WHERE a.name STARTS WITH "Zoom"

The above query returns assets whose names begin with "Zoom".

ENDS WITH​

Use ENDS WITH to find records where the attribute ends with a specific substring.

FIND Asset AS a
WHERE a.name ENDS WITH ".com"

The above query returns assets where the name ends with ".com".

NOT ENDS WITH​

Use NOT ENDS WITH to exclude results where the attribute ends with a specific substring.

FIND Asset AS a
WHERE a.name NOT ENDS WITH ".com"

The above query returns assets where the name does not end with ".com".

Last updated on