https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-help-event-id/m-p/584060#M6528 <P>Looking for xql query to find folder name change or folder move event id on particular server.</P> Wed, 17 Apr 2024 15:47:54 GMT S.Ahmad 2024-04-17T15:47:54Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-help-event-id/m-p/584060#M6528 <P>Looking for xql query to find folder name change or folder move event id on particular server.</P> Wed, 17 Apr 2024 15:47:54 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-help-event-id/m-p/584060#M6528 S.Ahmad 2024-04-17T15:47:54Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-help-event-id/m-p/584094#M6530 <P>Hi S.Ahmad,&nbsp;</P> <P>&nbsp;</P> <P>From Cortex XDR, select Incident Response → Investigation → Query Builder → Event Log to query by Event ID and Process path.&nbsp;</P> <P>Reference</P> <P><A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Query-Builder" target="_blank">Query Builder • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal</A></P> <P>&nbsp;</P> <P>Thank you</P> Wed, 17 Apr 2024 20:34:54 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-query-help-event-id/m-p/584094#M6530 jtalton 2024-04-17T20:34:54Z