Search Filter Operators
Supported operators for Panther's Search tool
Supported operators
Operator | Usage guidelines | Supported field types | Examples |
---|---|---|---|
is / is not | Valid for a single value. Results include only events where the field matches/ does not match the value in the filter. | string, number | username is “root” |
is empty / is not empty | Valid for an event where the field's value is not specified. The operator tests only for the absence of data. | string | errors_list is empty |
is in list / is not in list | Valid for multiple values. Results include only events where the field matches/does not match an entry in the list of values in the filter. | string | username is in [ “root”, “admin” ] |
has substring / does not have substring | Valid for a single value. Results include only events where the field contains/does not contain the value in the filter. | string | domain contains “.google.com” |
like / is not like | Valid for a single value. Results include only events where the field matches the pattern specified in the filter.
Wildcards are supported in the pattern. An underscore ( | string | role like “admin_” role like "%admin%" role like "admin*" |
equals / does not equal | Valid for a single value. Results include only events where the field matches/does not match the value in the filter. | number | count = 100 |
is greater than | Valid for a single value. Results include only events where the field is greater than the value in the filter. | number | port > 1023 |
is less than | Valid for a single value. Results include only events where the field is less than the value in the filter. | number | port < 1024 |
is greater than or equal to | Valid for a single value. Results include only events where the field is greater than or equal to the value in the filter. | number | count ≥ 1 |
is less than or equal to | Valid for a single value. Results include only events where the field is less than or equal to the value in the filter. | number | count ≤ 100 |
has / does not have | Valid for events that contain a specific single value. Results include only events that contain/do not contain the value in the filter. | array | domain has "google.com" where domain is an array of values |
has any / does not have any | Valid for events that contain any one of an array of values. Results include only events that contain/do not contain any of the values in the array. | array | domain has any "google.com", "yahoo.com" where domain is an array of values |
is true / is false | Valid for a single boolean value. Results include events where the boolean field is true or false. | boolean | success is true |
is after | Valid for a single time value. Results include events that occurred after the specified time value. | time | timestamp is after |
is before | Valid for a single time value. Results include events that occurred before the specified time value. | time | timestamp is before |
is null / is not null | Valid for an event where the field's value is null. The operator tests for a null value. | universal | errorCode is null |
contains / does not contain | Valid for events that include objects that contain/do not contain fields with values that match the value in the filter. The provided key in the filter can be top level or can use dot notation to indicate a nested path. | object | actor contains username actor.attributes does not contain Admin where actor is a nested object |
is within CIDR | Valid if a value is within a provided CIDR range | string | ip is within CIDR 10.2.3.0/24 |
Supported field types
Field types | Description |
---|---|
| A string value |
| A 32-bit integer number or 64-bit floating point number |
| A boolean value |
| A JSON array where each element is of the same type |
| A valid timestamp |
| A JSON object |
Last updated