From 2553b1268fb23361bf59275b00d3449dd25e7f33 Mon Sep 17 00:00:00 2001 From: Jean GOUDY Date: Mon, 27 May 2024 18:37:08 +0200 Subject: [PATCH] update(search-regex): add a note for regex --- docs/xdr/features/investigate/events_query_language.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/xdr/features/investigate/events_query_language.md b/docs/xdr/features/investigate/events_query_language.md index b82e398f69..b4a94b8645 100644 --- a/docs/xdr/features/investigate/events_query_language.md +++ b/docs/xdr/features/investigate/events_query_language.md @@ -30,6 +30,9 @@ A term without a field name and an operator will search the literal value in all | Wildcards | Wildcard characters can be used to match more events. Use `?` to match a single character or `*` to replace any number of characters. | `evil*` | | Regular Expressions | Regular Expressions can be used to filter for specific values. The regular expression is surrounded by forward slashes (`/`) | `/(evil|bad).*/` +!!! Note + For regular expressions, do not use `^` and `$` which delimits the beginning and the ending of a line. + ## Operators ### Term Operators