filtering by action_process_image_name

[brian159j]

Hello,

I'm building an XQL query to flag machines actively using Java — basically, looking for recent execution of java.exe or javaw.exe over the last 30 days.

I’m leaning towards filtering by action_process_image_name (since that’s the actual

process being executed), but I noticed some examples use actor_process_image_name. Just wanted to confirm — for Java usage, we should be looking at action, right?

Let me know if anyone has done something similar before!

Best Regard,

Brian

[DaBone]

Hello Brian,

This is not the forum for these types of questions.  This forum is for non-Palo Alto Networks customers to reach out to us with potential FPs.   More details in the pinned post at the top of this forum.  

Thank you!