Text Match examples

[mdhowle]

After reading the Falcon Query Language operators I was wondering how the ~ and !~ operators worked. There are examples for every operator except these. How would one use this? I haven't been able to figure out.

[crowdstrikedcs]

Hi @mdhowle thanks for the question!

The ~ (text match) operator:
Performs fuzzy text matching
Ignores:
Case (upper/lower)
Spaces
Punctuation

For example: hostname:~'lab machine' would match:

• "Lab-Machine"
• "LABmachine"
• "lab_machine"

The !~ (does not text match) operator:
Works exactly like ~ but returns the opposite result
Returns true when the text does NOT match

For example: hostname:!~'lab machine' would match everything EXCEPT variations of "lab machine"

Compared to regular string equality (:):
~ is more flexible for text searching
: requires exact matches including case and spacing

So you can use ~ when you need flexible text searching but use : when you need exact matching.

Let us know with any questions!

[mdhowle]

Thanks for the information. It seems like / is not considered a punctuation mark, which led to my confusion. I was hoping to use this operator because the falcon-sensor download data uses forward slashes extensively for multiple OSes and/or OS versions .

For example, these filters return no matches:

• os:'Debian'+os_version:~'10' or os:'Debian'+os_version:~'9 10 11 12'
• os:~'RHEL'+os_version:'8'

The JSON snippets that should match the filters above:

{
   "os": "Debian",
   "os_version": "9/10/11/12",
}

{
  "os": "RHEL/CentOS/Oracle",
  "os_version": "8",
}

As a workaround, I'm wrapping everything in wildcards which works but it's case-sensitive.

[crowdstrikedcs]

Seeing the same on my end. I can see it working in samples like this.

os_version:~'zLinux'

"os": "SLES",
"os_version": "15 - IBM zLinux",