Searching for a string that contains a comma in Incident Notes

Products

• Data Loss Prevention Enforce

Issue/Introduction

Using the Advanced filters and Summarization in the Incident List page of the Enforce console to filter incidents we are trying to filter incidents based on Incident Notes

We encountered a problem when the search string contains commas if we use “Contains any of”, the comma is seen as a separator rather than a part of the expression.

Ideally something like the below cases is to be found with such filters in the Notes:

Contains any of string1, , string2, , string3,

Contains any of string1, string2 , string3, string4  , string5, string6

Is there’s a way to escape the comma character in the search string?

Environment

Release : 15.8

Component : Default-Sym

Cause

Expected behaviour.

Resolution

There is no way to escape a comma in the current versions. 

The only alternative is to use the 'Contains Ignore Case' filter and enter a single string that can contain commas, white spaces or anything else.

The whole string is considered as a single token that must be found exactly as is within the incident notes.

You could define multiple such 'Contains Ignore Case' filters in the UI in an attempt to stack them up, but these filters will be ANDed instead of being ORed, therefore you can't achieve the behaviour of 'Contains Any Of' which ends up ORing the comma (or new line) separated tokens that you enter in the UI.