How does the "contains" method work when querying data in Panther?

Last updated
Save as PDF

QUESTION

How do I use the contains method when querying data in Data Explorer in my Panther Console? What's the difference between Athena and Snowflake's contains method?

ANSWER

Snowflake's contains can be a partial match for the data, and Snowflake's array_contains method requires an exact match for the data in question.

Examples

Snowflake

Snowflake contains method:

CONTAINS( <expr1> , <expr2> )
where <expr1> is 'The string to search in'.
and <expr2> is 'The string to search for'.

SELECT
    *
FROM
    panther_logs.public.okta_systemlog
WHERE
    contains(p_any_ip_addresses::varchar, '1.2')
LIMIT 10;

Snowflake array_contains method:

SELECT
    *
FROM
    panther_logs.public.okta_systemlog
WHERE
    array_contains('1.2.3.4'::variant, p_any_ip_addresses)
LIMIT 10;

Similarly for int values in the array_contains method:

SELECT
    *
FROM
    panther_logs.public.okta_systemlog
WHERE
    array_contains(7022::int, securityContext:asNumber)
LIMIT 10;

Additional information: