diff --git a/definitions/ChromiumBrowser_Cookies.yaml b/definitions/ChromiumBrowser_Cookies.yaml index 55e3b7e..9fd18aa 100644 --- a/definitions/ChromiumBrowser_Cookies.yaml +++ b/definitions/ChromiumBrowser_Cookies.yaml @@ -25,6 +25,7 @@ Sources: SELECT timestamp(winfiletime=(creation_utc * 10) || 0) AS CreationUTC, timestamp(winfiletime=(expires_utc * 10) || 0) AS ExpiresUTC, timestamp(winfiletime=(last_access_utc * 10) || 0) AS LastAccessUTC, + timestamp(winfiletime=(last_update_utc * 10) || 0) AS LastUpdateUTC, HostKey, Name, Path, Bool(Value=is_secure) AS IsSecure, Bool(Value=is_httponly) AS IsHttpOnly, @@ -40,6 +41,7 @@ Sources: cookies.creation_utc, cookies.expires_utc, cookies.last_access_utc, + cookies.last_update_utc, cookies.host_key AS HostKey, cookies.name AS Name, cookies.path AS Path, diff --git a/definitions/Firefox_History.yaml b/definitions/Firefox_History.yaml index 7c9a59e..fbbc6a2 100644 --- a/definitions/Firefox_History.yaml +++ b/definitions/Firefox_History.yaml @@ -29,7 +29,7 @@ Sources: `7`='TRANSITION_DOWNLOAD', `8`='TRANSITION_FRAMED_LINK', `9`='TRANSITION_RELOAD') VQL: | - SELECT VisitID, FromVisitID, + SELECT VisitID, FromVisitID, PlaceID, timestamp(epoch= visit_date) AS VisitDate, timestamp(epoch= last_visit_date) AS LastVisitDate, VisitCount, URL, Title, Description, @@ -45,6 +45,7 @@ Sources: SELECT moz_historyvisits.id AS VisitID, moz_historyvisits.from_visit AS FromVisitID, + moz_historyvisits.place_id AS PlaceID, moz_historyvisits.visit_date, moz_places.last_visit_date, moz_places.visit_count AS VisitCount,