investigate_user_activity
Correlates browser history, ShellBags, LNK files, and RecentDocs to reveal user browsing, file access, and folder navigation activity from forensic artifacts.
Instructions
Comprehensive user activity investigation. Correlates Browser History, ShellBags, LNK files, and RecentDocs to build a complete picture of user activity. Answers: What did the user browse? What files did they access? What folders did they navigate?
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results per source | |
| keyword | No | Optional keyword to search across all sources (URLs, filenames, paths) | |
| lnk_path | No | Override auto-detected Recent LNK folder path | |
| username | No | Optional username to narrow artifact search in multi-user images | |
| ntuser_path | No | Override auto-detected NTUSER.DAT path | |
| browser_path | No | Override auto-detected browser History path | |
| artifacts_dir | Yes | Base directory containing forensic artifacts or user profile | |
| usrclass_path | No | Override auto-detected UsrClass.dat path | |
| time_range_end | No | ISO format datetime - filter events before this time | |
| suspicious_only | No | For ShellBags, only return suspicious folder access (temp, AppData, network shares) | |
| time_range_start | No | ISO format datetime - filter events after this time |