The attack surfaces feature provides a set of query syntax for you to query information. This topic describes the operators that may be used in field query in the attack surfaces feature.

Supported operators

Operator Description Remarks
AND Indicates the "and" relationship. The query result must meet both query1 and query2. Format: query1 AND query2. If no operator is used between multiple query conditions, the relationship is AND by default.
OR Indicates the "or" relationship. The query result must meet either query1 or query2. Format:query1 OR query2. N/A
NOT Indicates the "not" relationship. The query result must not contain result that meets query1. Format:NOT query1. You can use this operator together with AND and OR. N/A
'''' Indicates exact match. The query result must exactly match query1. Format:<field>:"query1". N/A
> Queries the results that are greater than a specific number. Currently, this operator is supported only for port query in port service. For example, port > 80 is to query the ports whose ports number are greater than 80. N/A
>= Queries the results that are greater than or equal to a specific number. Currently, this operator is supported only for port query in port service. For example, port >= 80 is to query the ports whose ports number are greater than or equal to 80. N/A
< Queries the results that are less than a specific number. Currently, this operator is supported only for port query in port service. For example, port < 8080 is to query the ports whose ports number are less than 8080. N/A
<= Queries the results that are less than or equal to a specific number. Currently, this operator is supported only for port query in port service. For example, port <= 8080 is to query the ports whose ports number are less than or equal to 8080. N/A