Compare results in table to lookup?

[D.Demarest]

I have a lookup with software names and want to use it to compare it to results from xdr_data using the fields actor_process_image_path which is the dir the software in installed in.  

config case_sensitive = false
| dataset = xdr_data
| filter event_type = PROCESS and event_sub_type = PROCESS_START
| filter actor_process_image_path in (dataset = software| fields Apps)

the issue I have is that I CANNOT for the life of me figure out how to insert a "contain" statement to match, the software list does not have the full install path, just the name of the application, so its not matching even tho I have verified several isntances of apps isntalled on machines that have a match in the list. Example is like the app name is "AdobePDF" and i should be able to have statement that does something like:

actor_process_image_path contains  (software), or something like that so it looks thru the software lookup and matches if any of the apps is mentioned in actor_process_image_path .


Thank you!