Comparison operators

Use comparison operators in Trellix Query Language (TQL) to filter field values.

Equal and colon operators — The equal operator (=) and the colon operator (:) perform exact matching. You can use either operator interchangeably when comparing a field to a literal value.

For example:

eventType=api
eventType:api

In addition to equals, the other supported operator values are:

Syntax rules

Spacing — You can use spaces around operators for readability.
```
firewall.gti.score > 20
```
Order of operations — Comparison operators have the tightest binding in TQL. They are evaluated before logical operators such as AND, OR, or NOT.
```
!firewall.gti.score <= 20
```