topic XQL Query Help in Cortex XDR Discussions

XQL Query Help

Joe_Carissimo — Wed, 23 Jul 2025 20:22:31 GMT

Hi Live Community, I'm working on a query in XQL that can determine which applications in our Windows environment require Java to run.

My thought process is if a Windows workstation is using Java (java.exe or javaw.exe) in the past 30 days it must be needed.

I'm not too sure about the difference between actor_process_image_name OR action_process_image_name.

In this case would I want to look at both?

As always, thank you in advance.
Joe

Re: XQL Query Help

eluis — Fri, 25 Jul 2025 14:04:02 GMT

Hi Joe_Carissimo,

Please check the document:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Actor-Actor

You will see there that actor_process_image_name refers to the parent process (also known as CGO many times) and action_process_image_name refers to the child of the former (initiated process or target process)

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

Re: XQL Query Help

Joe_Carissimo — Fri, 25 Jul 2025 16:14:31 GMT

Hi @eluis, thanks for your reply. I am looking through that page you shared now. This is helpful.

Regards,

Joe