Hey Darryl,
Based on a DQL example (IF clause), I believe filename would be "basename". The example from the UI:
FROM path
get name,
active_users.name
IF basename IN ("ssn.csv","credit_cards.csv")
About
ACCREDITATIONS
STS Symantec Data Loss Prevention 11
STS Symantec PGP Universal Server 3.0
STS Symantec Messaging Gateway 10.0
STS Symantec Data Loss Prevention 12