Patterns and text

String fields can support contains, wildcard, or regular-expression matching. The dataset schema lists the operators available for each field.

Contains

The : operator performs the field’s normal match:

isp:"Cloudflare"
banner:"OpenSSH"

For contains-enabled strings, Infrawatch performs a case-insensitive substring match. Keyword-like enums and identifiers remain exact.

Use * inside a value where the field supports wildcard matching:

host:*.example.com
http.title:*dashboard*

An unescaped * by itself is an existence check.

Use =~ with a backtick-delimited expression:

domain=~`^api-[0-9]+\\.example\\.com$`

Regular expressions are validated and bounded before execution. Not every field enables them.

Quote values containing spaces, punctuation, or boolean words:

banner:"Dovecot ready"
http.title:"Sign in to your account"

Quoted banner values use exact and phrase-oriented matching. They do not use fuzzy matching.

On host and service search, a bare term searches observed banner text:

BusyBox

Quote a bare phrase when word order matters:

"Index of /"

Prefer a fielded query in saved searches and automation because it communicates intent and is easier to validate.

Use :~ to exclude the normal contains match:

banner:~"test server"

Or use NOT around any expression:

NOT (host:*.internal.example.com OR http.title:*staging*)

Check field types, supported operators, and aliases before building a long-lived query.