Skip to main content

Responses are generated using AI and may contain mistakes.

Attack Surface InsightsAttack Surface Insights Guide

Wildcards in Attack Surface Insights Search

When entering a search in Attack Surface Insights, use wildcard characters to stand in for unknown characters and search for multiple entities with similar but not identical attribute values.

To indicate that a query should be treated as a wildcard search, enclose the query in quotation marks.

Attack Surface Insights searches for all entities that match the wildcard search.

Attack Surface supports two wildcard characters:

  • * – Represents zero or more characters.

    Example

    "svc-backup-*" returns svc-backup- followed by zero or more characters.

    The query matches values like:

    • svc-backup-1

    • svc-backup-default

    • svc-backup-

  • ? – Represents any one character, except line terminations.

    Example

    "barbara?salazar" returns barbara followed by any one character, then salazar.

    The query matches values like:

    • barbara.salazar

    • barbaraxsalazar

    • barbara1salazar

Wildcard Search Limitations in Attack Surface Insights

There are a few limitations to using wildcard search in Attack Surface Insights:

  • Wildcard searches match the values of certain entity attributes only.

    For user entities, the only attributes that match a wildcard search are:

    • User name

    • Email address

    • Badge ID

    • Employee ID

    • User SID

    For device entities, the only attribute that matches a wildcard search is Host Name.

  • Wildcard searches always search the values of all eligible entity attributes. You can't search the values of a specific entity attribute.

    Example

    user_name: "barbara*" returns entities where user_name is literally barbara*.

    To use a wildcard search, you must enter "" as a standalone query that searches across all eligible entity attributes.

  • Search application wildcard operators like WLD() and WLDi() are not supported. To indicate that a query should be treated as a wildcard search, enclose the query in quotation marks.