[Osquery_manager] Browser History artifact saved query

[tomsonpl]

Browser History Artifact

This PR adds a new osquery saved query for the Browser History artifact, providing comprehensive browser activity collection across all platforms using the Elastic osquery extension. The query automatically discovers and collects browsing history from Chrome, Edge, Firefox, and Safari without requiring ATC configuration.

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	Browser History	✅	Windows, macOS, Linux	browser_history_elastic	b352f3c9	Collects browser history from all supported browsers across all platforms using the Elastic osquery extension

Queries by Platform

---

🪟🍎🐧 Cross-Platform - Browser History Collection

Description

This query leverages the Elastic osquery extension to collect browser history from all major browsers (Chrome, Edge, Firefox, Safari) across Windows, macOS, and Linux platforms. The extension automatically discovers browser profile locations and queries their history databases without requiring ATC (Automatic Table Construction) configuration.

The query returns the last 7 days of browsing activity, including:

• Full URLs with domain extraction
• Page titles and visit timestamps
• Browser identification
• User profiles
• Navigation transition types

Detection Focus:

• Data Exfiltration Detection: Identify suspicious file upload or cloud storage URLs
• Credential Phishing: Detect visits to fake login pages or credential harvesting sites
• Command & Control: Identify visits to known C2 infrastructure or suspicious domains
• Insider Threat Monitoring: Track access to unauthorized resources or data repositories
• Policy Compliance: Verify adherence to acceptable use policies

Result

Returns browsing history entries with timestamps, URLs, page titles, browser names, user profiles, and navigation context for the past 7 days.

Platform

windows, darwin, linux (cross-platform)

Interval

3600 seconds (1 hour)

Query ID

browser_history_elastic

ECS Field Mappings

• url.full → url
• event.action → title
• user_agent.name → browser
• user.name → user
• url.domain → domain
• event.category → web (static)
• event.type → info (static)

SQL Query

-- Browser history from Elastic osquery extension
-- Supports: Chrome, Edge, Firefox, Safari
-- Returns last 7 days of browsing activity
SELECT
  datetime,
  url,
  title,
  browser,
  user,
  domain,
  transition_type
FROM browser_history
WHERE timestamp > (strftime('%s', 'now') - 604800)
ORDER BY timestamp DESC;

Requirements

⚠️ IMPORTANT: This query requires the Elastic osquery extension (osquerybeat). The standard osquery does not include the browser_history table.

---

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: b1751e8

cc @tomsonpl

[ferullo]

Does a user need to know about the extension or would it make more sense to just say it requires Agent 9.3.0+?