Application Web Usage
Overview
Section titled “Overview”Evidence: Application Web Usage
Description: Collect Application Web Usage
Category: System
Platform: macos
Short Name: appweb
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”The KnowledgeC web usage stream records web domains visited through Safari and other apps along with the owning application and usage duration. It captures browsing activity even when browser history has been cleared.
Data Collected
Section titled “Data Collected”This collector gathers structured data about application web usage, including the application, domain, and timing. Results are recorded in app_web_usage.
Collection Method
Section titled “Collection Method”This collector reads KnowledgeC databases under user profiles and records application web usage into app_web_usage.
Forensic Value
Section titled “Forensic Value”This evidence ties users to visited web domains and durations, surviving browser history deletion and aiding exfiltration and command-and-control analysis.