How does the "contains" method work when querying data in Panther?

Last updated
Save as PDF

QUESTION

How do I use the contains method when querying data in Data Explorer in my Panther Console? What's the difference between Athena and Snowflake's contains method?

ANSWER

Athena's contains method requires an exact match for data you're searching. Snowflake's contains can be a partial match for the data, and Snowflake's array_contains method requires an exact match for the data in question.

Examples

Athena contains method:

SELECT
    *
FROM
    panther_logs.okta_systemlog
WHERE
    contains(p_any_ip_addresses, '1.2.3.4')
LIMIT 10

Snowflake contains method:

CONTAINS( <expr1> , <expr2> )
where <expr1> is 'The string to search in'.
and <expr2> is 'The string to search for'.

SELECT
    *
FROM
    panther_logs.public.okta_systemlog
WHERE
    contains(p_any_ip_addresses::varchar, '1.2')
LIMIT 10;

Snowflake array_contains method:

SELECT
    *
FROM
    panther_logs.public.okta_systemlog
WHERE
    array_contains('1.2.3.4'::variant, p_any_ip_addresses)
LIMIT 10;

Similarly for int values in the array_contains method:

SELECT
    *
FROM
    panther_logs.public.okta_systemlog
WHERE
    array_contains(7022::int, securityContext:asNumber)
LIMIT 10;