anchor.diff:  
   NOTE: `=` is not supported as an equal operator. Use `==` or `:` instead.
   
  -You cannot chain comparison operators. Instead, use a
  +[discrete]
  +[[limitations-for-comparisons]]
  +=== Limitations for comparisons
  +
  +You cannot chain comparisons. Instead, use a
   <<eql-syntax-logical-operators,logical operator>> between comparisons. For
   example, `foo < bar <= baz` is not supported. However, you can rewrite the
   expression as `foo < bar and bar <= baz`, which is supported.
   
  -You also cannot use comparison operators to compare a field to another field.
  -This applies even if the fields are changed using a <<eql-functions,function>>.
  +You also cannot compare a field to another field, even if the fields are changed
  +using a <<eql-functions,function>>.
   
   *Example* +
   The following EQL query compares the `process.parent_name` field
  
positive.code: 
  [source,eql]
  ----
  user.name in ("Administrator", "SYSTEM", "NETWORK SERVICE")
  user.name in~ ("administrator", "system", "network service")
  user.name not in ("Administrator", "SYSTEM", "NETWORK SERVICE")
  user.name not in~ ("administrator", "system", "network service")
  user.name : ("administrator", "system", "network service")
  ----
  
  `in` (case-sensitive)::
  Returns `true` if the value is contained in the provided list.
  
  `in~` (case-insensitive)::
  Returns `true` if the value is contained in the provided list.
  
  `not in` (case-sensitive)::
  Returns `true` if the value is not contained in the provided list.
  
  `not in~` (case-insensitive)::
  Returns `true` if the value is not contained in the provided list.
  
  `:` (case-insensitive)::
  Returns `true` if the string is contained in the provided list. Can only be used
  
negative.code: // |  +-----------+     +-----------+     +------------+  |
  // +------------------------------------------------------+
  ----
  ====
  