Operators and Data Types

Binary

Binary fields contain either “0” (zero) or “1” (one).

operator name	display name	description
==	is	Field value is True or 1 Field value is False or 0
!=	is not	Field value is not True or 1 Field value is not False or 0
exists	exists	Field exists and has a value
empty	empty	Field does not exist or has no value

Datetime

Date/Time fields contain a timestamp that includes date and time. For example, the field First Time Seen is a datetime field.
For Fields that contain date and time values, the list of Operators includes:

operator name	display name
==	is equal to	Date and time matches the specified date and time
>=	is greater than or equal to	Date and time matches the specified date and time or is a more recent
>	is greater than	Date and time is more recent than the specified date and time
<=	is less than or equal to	Date and time matches or is earlier than the specified date and time
<	is less than	Date and time is earlier than the specified date and time
within past	within past	Date and time is within the specified range Note that the value for this operator is of the format: “value” “<integer>, <range>” There is a comma between <integer> and <range> For example, `"searchFieldName":"First_Time_Seen",` `"operator":"within past", "type":"Datetime",` `"value":"30, days"`
not within past	not within past	Date and time is not within the specified range Note that the value for this operator is of the format: “value” “<integer>, <range>” There is a comma between <integer> and <range> For example, `"searchFieldName":"First_Time_Seen",` `"operator":"not within past", "type":"Datetime",` `"value":"2, weeks"`
within future	within future	Date and time is within the specified future range Note that the value for this operator is of the format: “value” “<integer>, <range>” There is a comma between <integer> and <range> For example, `"searchFieldName":"First_Time_Seen",` `"operator":"within future", "type":"Datetime",` `"value":"1, month"`
not within future	not within future	Date and time is not within the specified future range Note that the value for this operator is of the format: “value” “<integer>, <range>” There is a comma between <integer> and <range> For example, `"searchFieldName":"First_Time_Seen",` `"operator":"not within past", "type":"Datetime",` `"value":"1, month"`
exists	exists	Field exists and has a value
empty	empty	Field does not exist, or field has no value

Float/Integer

Float or Integer fields contain numeric values. For example, the field Memory Size is a numeric field.

Float fields include a decimal point and values after the decimal point.
Integers are whole numbers with no decimal point.

For Fields that contain numeric values, the list of Operators includes:

operator name	display name	description
==	is equal to	Field value is equal to specified value
>=	is greater than or equal to	Field value is greater than or equal to specified value
>	is greater than	Field value is greater than specified value
<=	is less than or equal to	Field value is less than or equal to specified value
<	is less than	Field value is less than the specified value
!=	is not equal to	Field value is not equal to specified value
exists	exists	Field exists and has a value
empty	empty	Field does not exist or field has no value

List

List fields include a list of comma-separated values. Each value has an index.

For example, the List field IP Address for a single asset could have the values:10.18.53.250,10.195.226.126,10.204.142.70,10.73.140.162,10.96.202.137,172.22.67.137,191.179.24.31,192.168.102.60,192.168.106.117,192.168.107.146,192.168.107.215,192.168.52.47,192.168.65.152,198.104.133.78,228.156.37.223

Each IP address has an index number. The first value in the list has the index value “0” (zero). The last value in the list has the index value “13” because there are 14 values in the list.

operator name	display name	description
match	match	List includes one or more entries where all or part of the entry matches a specified string or regular expression. You can include multiple strings, separated with commas. The matches are not case sensitive. The query results include only list entries that match the string or regular expression.
not match	not match	List includes one or more entries where all or part of the entry does not match a specified string or regular expression. You can include multiple strings, separated with commas. The matches are not case sensitive. The query results include only list entries that do not match the string or regular expression.
in	is equal to	List includes one or more entries that are an exact match to a specified string. You can include multiple strings, separated with commas. The matches are case sensitive. The query results include only list entries that are an exact match for the specified string.
not in	is not equal to	List includes one or more entries that is not an exact match to specified string. You can include multiple strings, separated with commas. The matches are case sensitive. The query results include only list entries that are not an exact match for the specified string.
length gt	count is greater than	The number of list entries is greater than the specified number.
length lt	count is less than	The number of list entries is less than the specified number.
length eq	count is equal to	The number of list entries is equal to the specified number.
exists	exists	Field exists and has a value
empty	empty	Field does not exist or field does not have a value

String/Text

Text fields include strings of text. For example, the field Country Name is a text field.

For Fields that contain text values, the list of Operators includes:

operator name	display name	description
match	match	All or part of the field matches a specified string or regular expression. The matches are not case sensitive. The query results include only fields that match the string or regular expression.
not match	not match	All or part of the field matches a specified string or regular expression. The matches are not case sensitive. The query results include only fields that do not match the string or regular expression.
==	is equal to	The field is an exact match to the specified value. The matches are case sensitive.
!=	is not equal to	The field is not an exact match to the specified value. The matches are case sensitive.
exists	exists	Field exists and has a value
empty	empty	Field does not exist or field does not have a value