This topic describes the search behavior you can expect to experience when you specify criteria in Build Mode or a query in Query Mode.

User Input

Console

  • Build Mode
    • Restricts possible queries.
    • Users do not escape; the console interprets user input literally.
    • A term contains is a value that does not include spaces.
    • A phrase contains is a value separated by spaces.
  • Query Mode
    • Allows for query flexibility.
    • Escapes all special characters and forward slash for term contains for values input in Build Mode.
    • Escapes all special characters, forward slash, and spaces for starts with and ends with values input in Build Mode.
    • Escapes forward slash for CIDR values input in Build Mode.
    • Surrounds value with double quotation marks for equals and phrase contains values that specify a space input in Build Mode.
    • Boolean values must be lower case.

API

The input to the API is a JSON object. Escaping double quotes, backslashes, and forward slashes is necessary for Carbon Black Cloud to parse the JSON object correctly.

Asset Group Search

Asset Group Search is similar to the queries you can create using Inventory Search. See also Inventory Search and Platform Search.

Note: A built-in Asset Group called None can be used to identify assets that do not belong to any Asset Group. "None" is a reserved word in Asset Groups, and therefore special search considerations apply.

Example:

Your organization has the following Asset Groups:

  • Eng_Boston_Office
  • Office_None
  • Nonbinding

Search filters include the built-in Asset Group and display as:

  • Eng_Boston_Office
  • Office_None
  • Nonbinding
  • None

A search for asset_group: Office matches Eng_Boston_Office and Office_None.

A search for asset_group: none matches None but does not match Office_None.

A search for asset_group: non* matches Nonbinding but does not match None.