investigate_user_activity
Identify what users browsed, accessed, and navigated by correlating browser history, ShellBags, LNK files, and RecentDocs.
Instructions
Comprehensive user activity investigation. Correlates Browser History, ShellBags, LNK files, and RecentDocs to build a complete picture of user activity. Answers: What did the user browse? What files did they access? What folders did they navigate?
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| artifacts_dir | Yes | Base directory containing forensic artifacts or user profile | |
| keyword | No | Optional keyword to search across all sources (URLs, filenames, paths) | |
| username | No | Optional username to narrow artifact search in multi-user images | |
| time_range_start | No | ISO format datetime - filter events after this time | |
| time_range_end | No | ISO format datetime - filter events before this time | |
| suspicious_only | No | For ShellBags, only return suspicious folder access (temp, AppData, network shares) | |
| browser_path | No | Override auto-detected browser History path | |
| lnk_path | No | Override auto-detected Recent LNK folder path | |
| usrclass_path | No | Override auto-detected UsrClass.dat path | |
| ntuser_path | No | Override auto-detected NTUSER.DAT path | |
| limit | No | Maximum results per source |