---
title: "calicoq and selectors"
description: "Reference for selector syntax accepted by calicoq in Calico Enterprise when matching endpoints, policies, or profiles."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Reference"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/reference/clis/calicoq/selectors"
---

# calicoq and selectors

The queries that you can make with `calicoq` all involve computing the matches between endpoints and policies or profiles, via selectors.

Selectors can be used in the following three contexts in Calico Enterprise security policy definitions:

- A selector can be used in the definition of each Calico Enterprise Policy object, to specify the endpoints (pods) that the policy applies to (`spec.selector`).

- A selector can be used in each ingress Rule, to specify that the Rule only matches packets sent from a particular set of endpoints (`source.selector`), or packets from all endpoints except a particular set (`source.notSelector`).

- A selector can be used in each egress Rule, to specify that the Rule only matches packets sent to a particular set of endpoints (`destination.selector`), or packets to all endpoints except a particular set (`destination.notSelector`).

Note: the use of selectors in Calico Enterprise policy is described in detail by [NetworkPolicy](https://docs.tigera.io/calico-enterprise/latest/reference/resources/networkpolicy.md) and [GlobalNetworkPolicy](https://docs.tigera.io/calico-enterprise/latest/reference/resources/globalnetworkpolicy.md).

Kubernetes NetworkPolicy definitions are similar but less general: they do not support egress rules or the `notSelector` options.