https://live.paloaltonetworks.com/t5/virustotal/filtering-by-action-process-image-name/m-p/1234732#M3051 <P>Hello Brian,</P> <P><BR />This is not the forum for these types of questions.&nbsp; This forum is for non-Palo Alto Networks customers to reach out to us with potential FPs.&nbsp; &nbsp;More details in the pinned post at the top of this forum.&nbsp;&nbsp;</P> <P>&nbsp;</P> <P>Thank you!</P> Sat, 26 Jul 2025 16:13:27 GMT DaBone 2025-07-26T16:13:27Z https://live.paloaltonetworks.com/t5/virustotal/filtering-by-action-process-image-name/m-p/1234634#M3050 <P>Hello,</P> <P>&nbsp;</P> <P>I'm building an XQL query to flag machines actively using Java — basically, looking for recent execution of java.exe or javaw.exe over the last 30 days.</P> <P>&nbsp;</P> <P>I’m leaning towards filtering by action_process_image_name (since that’s the actual</P> <P>&nbsp;</P> <P>process being executed), but I noticed some examples use actor_process_image_name. Just wanted to confirm — for Java usage, we should be looking at action, right?</P> <P>&nbsp;</P> <P>Let me know if anyone has done something similar before!</P> <P>&nbsp;</P> <P>Best Regard,</P> <P>Brian</P> Thu, 24 Jul 2025 10:19:28 GMT https://live.paloaltonetworks.com/t5/virustotal/filtering-by-action-process-image-name/m-p/1234634#M3050 brian159j 2025-07-24T10:19:28Z https://live.paloaltonetworks.com/t5/virustotal/filtering-by-action-process-image-name/m-p/1234732#M3051 <P>Hello Brian,</P> <P><BR />This is not the forum for these types of questions.&nbsp; This forum is for non-Palo Alto Networks customers to reach out to us with potential FPs.&nbsp; &nbsp;More details in the pinned post at the top of this forum.&nbsp;&nbsp;</P> <P>&nbsp;</P> <P>Thank you!</P> Sat, 26 Jul 2025 16:13:27 GMT https://live.paloaltonetworks.com/t5/virustotal/filtering-by-action-process-image-name/m-p/1234732#M3051 DaBone 2025-07-26T16:13:27Z