Use single quotes (' ') or double quotes (" ") in Trellix Query Language (TQL) to search for specific types of values.
Use quotes for the following:
Exact strings, including those containing spaces.
Reserved keywords (such as
andoror) to treat them as literal values.Plain text values that are not part of a regular expression.
You can use the quoting styles interchangeably. For example, eventType='api' and eventType="api" produce the same result.
When to use quotes
Quoting ensures that TQL interprets the value literally rather than as a keyword, number, or expression.
Examples:
count>"4"— Searches for the literal string "4" (not the numeric value 4).description:"/wmps/"— Searches for the exact text "/wmps/" (unlikedescription:/wmps/, which is interpreted as a regular expression).
Escaping quotes
To search for a quote character within a string, precede it with an escape character (backslash).
Double quote:
\"Single quote:
\'
Note
TQL interprets backticks (
`) the same way as single and double quotes when used for literal values.