For example, the following rules uses the greater than and equal operators:

You can use the following operators while writing rules:

= (equal)

!= (not equal)

> (greater than)

>= (greater than or equal)

< (less than)

<= (less than or equal)

contains

equalsSet

has

in

match

notmatch

unmatched

search

unique

group by

distinct

The unmatched operators function differently based on whether the rule includes two items, an item and then a list, a list and then an item, or two lists. An item can be a single event, a text watchlist, or a single value returned from an analytic function. A list can be a list watchlist, an event set, or an array returned from an analytic function.

Avoid using unique, match, and not match operators. These operators exist only for backward compatibility. Instead, use the distinct, group by, and unmatched filters.