Has

Definition

The `has` operator in Kusto Query Language (KQL) checks if a string contains a specific whole term. It’s case-insensitive and only matches complete tokens, not partial words. This makes it useful when you want precise matches without catching similar-but-not-identical words.

Basic syntax:

```kusto
ColumnName has "term"
```

If a column contains `The quick brown fox`, then:

* `has "quick"` → true
* `has "Quick"` → true (case-insensitive)
* `has "qui"` → false (not a whole word)
* `has "foxes"` → false (different word)

Example – searching logs for a keyword:

```kusto
SecurityEvent
| where EventData has "failed"
```

This matches events where the word “failed” appears in `EventData`. It won’t match “failure” or “unfailed.”

Example – matching hostnames:

```kusto
DnsEvents
| where DomainName has "example"
```

Matches domains like `www.example.com` or `example.net` but not `exemplar.com`.

**Comparing `has` with `contains`:**

In KQL, both `has` and `contains` check if a string includes something you’re looking for, but they behave very differently — and choosing the wrong one can mean missing data or getting a bunch of false positives.

`has` looks for **whole terms**. It splits the text into tokens (words separated by spaces, punctuation, etc.) and matches only if your search term is a complete token. It’s case-insensitive by default.
Example: If the text is `"failed login attempt"`

* `has "login"` → true (it’s a whole word)
* `has "log"` → false (it’s only part of the word “login”)

`contains` looks for **any substring match**. It doesn’t care if your term is part of another word or token. It’s also case-insensitive by default.
Example: If the text is `"failed login attempt"`

* `contains "log"` → true (matches inside “login”)
* `contains "LOGIN"` → true (case-insensitive)

Why this matters in investigations:
If you’re looking for the username `"tom"`,

* `has "tom"` will match `tom logged in` but not `tommy logged in`
* `contains "tom"` will match both `tom` and `tommy`

When to use `has`:

* You need precision — matching a full token only
* You want to avoid matching parts of unrelated words

When to use `contains`:

* You want flexibility — matching even if the term appears inside another word
* You’re searching free-form text where partial matches are valuable

Example comparison in KQL:

```kusto
print str = "ant bat cat battle"
| extend has_bat = str has "bat"
| extend contains_bat = str contains "bat"
```

* `has_bat` → true for `"ant bat cat battle"` because “bat” appears as a whole word
* `contains_bat` → true as well, but it would also be true if the only match was “battle”

Has

Definition

Explore More Terms