Package Install History
Overview
Evidence: Package Install History
Description: Collect Package Install History
Category: System
Platform: macos
Short Name: pkghist
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Package installation history tracks software installs by package IDs. This data is essential for change auditing, detecting unauthorized installs, and reconstructing software timelines.
Data Collected
This collector gathers structured data about package install history.
Package Install History Data
| Field | Description | Example |
|---|---|---|
PackageID | Package ID | Example value |
Name | Name | Example value |
Version | Version | Example value |
Source | Source | Example value |
ContentType | Content Type | Example value |
Time | Time | 2023-10-15 14:30:25+03:00 |
Collection Method
This collector queries the package_install_history table via osquery and records into package_install_histories.
Forensic Value
This evidence is crucial for forensic investigations as it reveals what was installed, when, and by whom, aiding attribution and scope analysis.