mac_quarantine_events
Extract and analyze macOS quarantine events to uncover file download history, including source, app, and timestamp, with filters for filename and time range.
Instructions
Get quarantine events (file downloads) from QuarantineEventsV2. Shows download source, app that downloaded, timestamp.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| db_path | Yes | Path to QuarantineEventsV2 database | |
| time_end | No | ISO datetime - filter before this time | |
| time_start | No | ISO datetime - filter after this time | |
| filename_filter | No | Filter by filename |