Application Web Usage

Evidence: Application Web Usage
Description: Collect Application Web Usage
Category: System
Platform: macos
Short Name: appweb
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

The KnowledgeC web usage stream records web domains visited through Safari and other apps along with the owning application and usage duration. It captures browsing activity even when browser history has been cleared.

This collector gathers structured data about application web usage, including the application, domain, and timing. Results are recorded in app_web_usage.

This collector reads KnowledgeC databases under user profiles and records application web usage into app_web_usage.

This evidence ties users to visited web domains and durations, surviving browser history deletion and aiding exfiltration and command-and-control analysis.