Skip to main content
Panther Knowledge Base

How does the "contains" method work when querying data in Panther?

QUESTION

How do I use the contains method when querying data in Data Explorer in my Panther Console? What's the difference between Athena and Snowflake's contains method?

ANSWER

 Athena's contains method requires an exact match for data you're searching. Snowflake's contains can be a partial match for the data, and Snowflake's array_contains method requires an exact match for the data in question.

 

Examples

Athena contains method: 

SELECT
    *
FROM
    panther_logs.okta_systemlog
WHERE
    contains(p_any_ip_addresses, '1.2.3.4')
LIMIT 10

Snowflake contains method:

CONTAINS( <expr1> , <expr2> )
where <expr1> is 'The string to search in'.
and <expr2> is 'The string to search for'.
SELECT
    *
FROM
    panther_logs.public.okta_systemlog
WHERE
    contains(p_any_ip_addresses::varchar, '1.2')
LIMIT 10; 

Snowflake array_contains method:

SELECT
    *
FROM
    panther_logs.public.okta_systemlog
WHERE
    array_contains('1.2.3.4'::variant, p_any_ip_addresses)
LIMIT 10;

Similarly for int values in the array_contains method:

SELECT
    *
FROM
    panther_logs.public.okta_systemlog
WHERE
    array_contains(7022::int, securityContext:asNumber)
LIMIT 10;
  • Was this article helpful?