https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-escape-a-wildcard/m-p/1243822#M8916 <P>How could you escape a wildcard in a query</P> <P>For example if i am looking for suspicious LDAP queries like&nbsp;(objectclass=*), i need that to be literal and not match on things like objectclass=example. I have tried many different combinations including just a simple \* but have not found anything that works</P> Fri, 12 Dec 2025 20:11:16 GMT clairamore 2025-12-12T20:11:16Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-escape-a-wildcard/m-p/1243822#M8916 <P>How could you escape a wildcard in a query</P> <P>For example if i am looking for suspicious LDAP queries like&nbsp;(objectclass=*), i need that to be literal and not match on things like objectclass=example. I have tried many different combinations including just a simple \* but have not found anything that works</P> Fri, 12 Dec 2025 20:11:16 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-escape-a-wildcard/m-p/1243822#M8916 clairamore 2025-12-12T20:11:16Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-escape-a-wildcard/m-p/1244405#M8920 <P>I'm really happy that you asked this question. It took me forever to develop a method.&nbsp;</P> <P>Try out the following snippet in your query:&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">| alter esc_wildcard = replex(&lt;data_field&gt;, "[^\*]","") | filter (`esc_wildcard` not in (null, """""")) </LI-CODE> <P>&nbsp;</P> Mon, 22 Dec 2025 16:09:45 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-escape-a-wildcard/m-p/1244405#M8920 ChrisDavila 2025-12-22T16:09:45Z