From e3787b73d2248d040246cfd3ab0075f94af7cb96 Mon Sep 17 00:00:00 2001 From: NicknameNotTaken <61712629+NicknameNotTaken@users.noreply.github.com> Date: Mon, 14 Sep 2026 16:03:08 +0200 Subject: [PATCH 1/2] Extract LastUpdateUTC from Chromium cookies --- definitions/ChromiumBrowser_Cookies.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/definitions/ChromiumBrowser_Cookies.yaml b/definitions/ChromiumBrowser_Cookies.yaml index 55e3b7e..9fd18aa 100644 --- a/definitions/ChromiumBrowser_Cookies.yaml +++ b/definitions/ChromiumBrowser_Cookies.yaml @@ -25,6 +25,7 @@ Sources: SELECT timestamp(winfiletime=(creation_utc * 10) || 0) AS CreationUTC, timestamp(winfiletime=(expires_utc * 10) || 0) AS ExpiresUTC, timestamp(winfiletime=(last_access_utc * 10) || 0) AS LastAccessUTC, + timestamp(winfiletime=(last_update_utc * 10) || 0) AS LastUpdateUTC, HostKey, Name, Path, Bool(Value=is_secure) AS IsSecure, Bool(Value=is_httponly) AS IsHttpOnly, @@ -40,6 +41,7 @@ Sources: cookies.creation_utc, cookies.expires_utc, cookies.last_access_utc, + cookies.last_update_utc, cookies.host_key AS HostKey, cookies.name AS Name, cookies.path AS Path, From 52c65484dfa54bdcc49dcef6bc5a9c8ba2289d61 Mon Sep 17 00:00:00 2001 From: NicknameNotTaken <61712629+NicknameNotTaken@users.noreply.github.com> Date: Mon, 14 Sep 2026 16:04:23 +0200 Subject: [PATCH 2/2] Extract PlaceID from Firefox history --- definitions/Firefox_History.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/definitions/Firefox_History.yaml b/definitions/Firefox_History.yaml index 7c9a59e..fbbc6a2 100644 --- a/definitions/Firefox_History.yaml +++ b/definitions/Firefox_History.yaml @@ -29,7 +29,7 @@ Sources: `7`='TRANSITION_DOWNLOAD', `8`='TRANSITION_FRAMED_LINK', `9`='TRANSITION_RELOAD') VQL: | - SELECT VisitID, FromVisitID, + SELECT VisitID, FromVisitID, PlaceID, timestamp(epoch= visit_date) AS VisitDate, timestamp(epoch= last_visit_date) AS LastVisitDate, VisitCount, URL, Title, Description, @@ -45,6 +45,7 @@ Sources: SELECT moz_historyvisits.id AS VisitID, moz_historyvisits.from_visit AS FromVisitID, + moz_historyvisits.place_id AS PlaceID, moz_historyvisits.visit_date, moz_places.last_visit_date, moz_places.visit_count AS VisitCount,