anchor.diff:  ----
   user.name in ("Administrator", "SYSTEM", "NETWORK SERVICE")
   user.name not in ("Administrator", "SYSTEM", "NETWORK SERVICE")
  +user.name : ("administrator", "system", "network service")
   ----
   
   `in` (case-sensitive)::
  
positive.code: `not in` (case-sensitive)::
  Returns `true` if the value is not contained in the provided list. For strings,
  matching is case-sensitive.
  
  [discrete]
  [[eql-syntax-math-operators]]
  
negative.code: `:` (equal, case-insensitive)::
  Returns `true` if strings to the left and right of the operator are equal.
  Otherwise returns `false`. Matching is case-insensitive and can only be used to
  compare strings. Supports <<eql-syntax-wildcards,wildcards>> and
  <<eql-syntax-lookup-operators,list lookups>>.
  
  [IMPORTANT]
  ====
  