anchor.diff:  `not in` (case-sensitive)::
   Returns `true` if the value is not contained in the provided list. For strings,
   matching is case-sensitive.
  +
  +`:` (case-insensitive)::
  +Returns `true` if the value is contained in the provided list. Can only be used
  +to compare strings.
   
   [discrete]
   [[eql-syntax-math-operators]]
  
positive.code: ----
  user.name in ("Administrator", "SYSTEM", "NETWORK SERVICE")
  user.name not in ("Administrator", "SYSTEM", "NETWORK SERVICE")
  ----
  
  `in` (case-sensitive)::
  
negative.code: 
  [source,eql]
  ----
  field : "f*o"
  field : "*foo"
  field : "foo*"
  ----
  
  The `:` operator also supports wildcards in <<eql-syntax-lookup-operators,list
  lookups>>:
  
  [source,eql]
  ----
  field : ("f*o", "*bar", "baz*", "qux")
  ----
  
  [discrete]
  