XQL query help event id

[S.Ahmad]

Looking for xql query to find folder name change or folder move event id on particular server.

[jtalton · Accepted solution]

Hi S.Ahmad, 

From Cortex XDR, select Incident Response → Investigation → Query Builder → Event Log to query by Event ID and Process path. 

Reference

Query Builder • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation porta...

Thank you