For example, Rule Test with the following query :
device.type = "winevent_nic" && alert.id = "access:privilege-escalation-success" && ip.addr = "13.101.134.216"
returns 12 values. However, Rule Test with the following query (same exact time range):
device.type = "winevent_nic" && alert.id = "access:privilege-escalation-success" && ip.addr begins "13.101."
returns "No Values Available For The Rule."
In 9.8 at least, it doesn't appear that "begins" is a valid comparison operator for ip.src, ip.dst, or ip.addr -- the only comparison options are =, !=, exists, and !exists.
You can do VLSM "equality" matches against the IP-based fields which you could use to accomplish the same result:
ip.src = 13.101.0.0/16
As an aside, I've also heard it suggested that the use of ip.addr may not always work the way you would expect and that it's better to use ip.src and/or ip.dst (i.e. ip.src=1.2.3.4 || ip.dst=1.2.3.4 if you want to match either address), but perhaps one of the official RSA folk can speak to whether there is truth in that.