Wazuh and chrome history

[Massimiliano De Falco]

Good morning, I have the wazuh server on ubuntu linux and clients endpoints  v.4.3.10  on  win10.
Each client have google chrome browser installed. Is possible view the chrome history sites in wazuh console (best if in separate tab)?
Thanks.

[Gabriel Emanuel Valenzuela]

Hi Max ! How are you ?

Chrome history is stored in an SQLite database, the filenme is History and can be found in the following locations:

Microsoft Windows Vista, 7, 8, 10, 11

C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default

Linux/Unix

/home/<username>/.config/google-chrome/Default

macOS

/Users/<username>/Library/Application Support/Google/Chrome/Default

The tables containing the Chrome browsing history in the History database are named urls and visits. Data from these tables can be joined together to retrieve the URL, page title, and time it was accessed.

| Column | Type | Description | 

| id | INTEGER | PK | | url | LONGVARCHAR | The URL that was accessed | 

| url | LONGVARCHAR | The URL that was accessed| 

| title | LONGVARCHAR | The title of the website | 

| visit_count | INTEGER | The number of times the URL was accessed | 

| typed_count | INTEGER | The number of times the user got to this website by typing the URL in the address bar | 

| last_visit_time | INTEGER | Timestamp in nanoseconds when the website was last visited |

And the visits table

| Column | Type | Description | 

| id | INTEGER | PK | | url | LONGVARCHAR | The URL that was accessed | 

| url | LONGVARCHAR | The URL that was accessed| 

| visit_time | INTEGER | Timestamp in nanoseconds when the website was visited | 

Wazuh cannot monitor a SQLIte table directly, but you can create a script and extract all the information from these tables and store it in a log file for later analysis with Logdata collector.

I attach a link to our documentation about the logdata collector configuration, in short, it consists of a real-time process making sense of the records generated by servers or devices. This component can receive logs through text files or Windows event logs. It can also directly receive logs via remote syslog which is useful for firewalls and other such devices.

If you need anything more, please don't dub to ask. We're here to help 

Have a nice day!