The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

Boolean operators

  • Published on Aug 26, 2026
  • 1 minute(s) read
Prev Next

Boolean operators include AND, OR, and NOT.

By default, a space between query terms is considered an implicit “and”, and the search is inclusive of all terms specified.

The order of precedence for AND, OR, and NOT is:

  1. NOT, which binds to what immediately follows it

  2. AND (explicit)

  3. AND (implicit, or no AND is entered, but a space exists between two terms)

  4. OR

The valid symbols for AND are:

  • AND

  • and

  • &&

  • (single empty space)

The valid symbols for OR are:

  • OR

  • or

  • || (double bars)

For example:

(network.srcIp="192.168.1.1" OR network.srcIp="192.168.1.4") and network.dstIp="192.26.65.230"
network.srcIp="192.168.1.1" OR network.srcIp="192.168.1.1"

The operator NOT binds to what is immediately after it. For example:

not eventType=api

The valid symbols for NOT are:

  • NOT

  • Not

  • ! (exclamation point with no space before next search term)

Note

The exclamation point (!) can only be used as a prefix for the colon (:) and equal (=) operators.