XQL Query Help

[Joe_Carissimo]

Hi Live Community, I'm working on a query in XQL that can determine which applications in our Windows environment require Java to run. 

My thought process is if a Windows workstation is using Java (java.exe or javaw.exe) in the past 30 days it must be needed.

I'm not too sure about the difference between actor_process_image_name OR  action_process_image_name.

In this case would I want to look at both?

As always, thank you in advance.
Joe

[eluis · Accepted solution]

Hi Joe_Carissimo,

Please check the document: 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Actor-Actor

You will see there that actor_process_image_name refers to the parent process (also known as CGO many times) and action_process_image_name refers to the child of the former (initiated process or target process)

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR, 

Luis

[Joe_Carissimo]

Hi @eluis, thanks for your reply. I am looking through that page you shared now. This is helpful. 

Regards,

Joe