Automating Chrome History Collection using CrowdStrike and Tracecat - Part 1: Foundation & Discovery

ls ~/Library/Application\ Support/Google/Chrome/Default/History

summary: Chrome Browser Artefacts Extraction for ${{ TRIGGER.Hostname }} via CrowdStrike RTR
description: A remote API RTR session has been initiated for ${{ TRIGGER.Hostname }} to extract chrome browser history for all profiles on the host's macOS device
priority: critical
status: in_progress

operation_id: QueryDevicesByFilter
params:
  filter: hostname:' ${{ TRIGGER.Hostname }}'

operation_id: GetDeviceDetails
params:
  ids: ${{ ACTIONS.query_devices_by_filter.result.body.resources[0] }}

${{ ACTIONS.query_devices_by_filter.result.status_code == 200 }}

script: |
  def main(device_details):
    """
    Validates that the target device meets forensic collection requirements.
    This is a critical pre-flight check before initiating remote evidence collection.
    
    Args:
        device_details: Device information from CrowdStrike API
        
    Returns:
        Dictionary with success status, device_id, and system_info for chain of custody
    """
    
    # ============================================================================
    # PLATFORM VALIDATION
    # ============================================================================
    # This workflow uses macOS-specific file paths (/Users/, /Library/, etc.)
    # Extract platform name and convert to lowercase for case-insensitive comparison
    
    platform = device_details.get("platform_name", "").lower()
    
    # Reject non-macOS devices to prevent path errors or failed collections
    if platform != "mac":
        return {
            "success": False,
            "error": f"Device is not macOS (platform: {platform}). This workflow only supports macOS."
        }
    
    # ============================================================================
    # DEVICE STATUS CHECK
    # ============================================================================
    # RTR requires the device to be online and responsive
    # Check if device status is "normal" (online, not contained, no errors)
    status = device_details.get("status", "")
    
    if status != "normal":
        return {
            "success": False, 
            "error": f"Device status is '{status}'. Device must be online and normal status for RTR collection."
        }
    
    # ============================================================================
    # FORENSIC METADATA EXTRACTION
    # ============================================================================
    # Establishes chain of custody and provides context for investigation
    # Extract key device identifiers and network information for documentation
    # This metadata will be included in case notes for forensic reporting
    
    system_info = {
        "hostname": device_details.get("hostname"),
        "platform": device_details.get("platform_name"),
        "os_version": device_details.get("os_version"),
        "last_seen": device_details.get("last_seen"),
        "first_seen": device_details.get("first_seen"),
        "system_manufacturer": device_details.get("system_manufacturer"),
        "system_product_name": device_details.get("system_product_name"),
        "external_ip": device_details.get("external_ip"),
        "local_ip": device_details.get("local_ip")
    }

    # ============================================================================
    # SUCCESS RESPONSE
    # ============================================================================
    # Return validated device_id for RTR session initialization
    # system_info will be used for case documentation and audit trail

    return {
        "success": True,
        "device_id": device_details.get("device_id"),  # Required for RTR session
        "system_info": system_info                      # For forensic documentation
    }

inputs:
  device_details: ${{ ACTIONS.get_device_details.result.body.resources[0] }}

${{ ACTIONS.get_device_details.result.status_code == 200 }}

channel: **ADD YOUR SLACK CHANNEL ID HERE**
blocks:
  - type: section
    text:
      type: mrkdwn
      text: |-
        🚨 *Forensic Collection Workflow Failed*

        The Chrome history collection workflow has encountered an error and could not complete successfully.        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: |-
        *Failure Details:*
        • Target Device: ${{TRIGGER.Hostname}}
        • Case ID: ${{ACTIONS.create_case.result.case_number}}
        • Timestamp: ${{FN.now()}}        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: |-
        *Immediate Actions Required:*
        • Review workflow execution
        • Investigate failure cause
        • Manual intervention may be required
        • Consider re-running collection if safe to do so        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: |-
        *🔗 Investigation Links:*
        • <https://tracecat.com/|*View Workflow Execution*> - Review failure details
        • <https://tracecat.com|*Case Management*> - Review case status
        • <https://[insert your CrowdStrike url here]/real-time-response/sessions/audit-logs|*RTR Audit Logs*> - Check RTR session status        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: ⚠️ *Forensic collection incomplete - manual review required*

operation_id: BatchInitSessions
params:
  body:
    host_ids:
      - ${{ ACTIONS.validate_device_for_collection.result.device_id }}
    queue_offline: false

${{ ACTIONS.validate_device_for_collection.result.success == True }}

script: |
  def main(rtr_response):
    """
    Extracts and validates RTR session identifiers from CrowdStrike API response.
    
    Args:
        rtr_response: Full API response from BatchInitSessions operation
        
    Returns:
        Flattened session data with batch_id, session_id, device_id for forensic commands
    """
    
    # ============================================================================
    # STATUS CODE VALIDATION
    # ============================================================================
    # Why: Confirm session creation succeeded before extracting data
    # How: Check for HTTP 201 (Created) - the success code for RTR sessions

    if rtr_response.get("status_code") != 201:
        errors = rtr_response.get('body', {}).get('errors', [])
        return {
            "success": False,
            "error": f"Failed to start batch RTR session: {rtr_response.get('status_code')} - {str(errors)}"
        }
    
    # ============================================================================
    # BATCH ID EXTRACTION
    # ============================================================================
    # Why: batch_id is required for ALL subsequent RTR commands (ls, cp, get, etc.)
    # How: Extract from top-level body - this is your "session group identifier"

    batch_id = rtr_response.get("body", {}).get("batch_id")
    if not batch_id:
        return {
            "success": False,
            "error": "No batch_id returned from batch session initialization"
        }
    
    # ============================================================================
    # DEVICE SESSION RESOURCES
    # ============================================================================
    # Why: Resources contain per-device session details (session_id, pwd, errors)
    # How: Navigate to nested resources object - structure is {device_id: {session_data}}

    resources = rtr_response.get("body", {}).get("resources", {})
    
    if not resources:
        return {
            "success": False,
            "error": "No session resources returned"
        }
    
    # ============================================================================
    # DYNAMIC DEVICE ID EXTRACTION
    # ============================================================================
    # Why: Device IDs are dynamic - we can't hardcode them in expressions
    # How: Get the first (and should be only) key from resources dictionary
    # Note: We only initialized one device, so resources should have exactly one entry

    device_id = list(resources.keys())[0]  # Extract the device ID dynamically
    session_info = resources[device_id]     # Get that device's session data
    
    # ============================================================================
    # SESSION DATA ASSEMBLY
    # ============================================================================
    # Why: Create clean, flat structure for easy reference in downstream actions
    # How: Extract session_id, working directory, and status flags
    return {
        "success": True,
        "batch_id": batch_id,              # Required for all RTR commands
        "device_id": device_id,            # Confirms which device we're connected to
        "session_id": session_info.get("session_id"),  # Unique session identifier
        "pwd": session_info.get("stdout", "/"),        # Current directory (from auto-run pwd)
        "complete": session_info.get("complete", False),  # Session initialization status
        "errors": session_info.get("errors", [])         # Any initialization warnings
    }

inputs:
  rtr_response: ${{ ACTIONS.initialise_rtr_session.result }}

${{ ACTIONS.initialise_rtr_session.result.status_code == 201 }}

case_id: ${{ ACTIONS.create_case.result.id }}
content: "RTR Session Established - Remote terminal response session successfully initiated with target endpoint ${{ TRIGGER.Hostname }} (Device ID: ${{ ACTIONS.validate_device_for_collection.result.device_id }}) at ${{ ACTIONS.initialise_rtr_session.result.headers.Date }}. Platform: macOS. Chain of custody initiated for Chrome browser history collection."

${{ ACTIONS.extract_session_information.result.status_code == 201 }}

channel: **ADD YOUR SLACK CHANNEL ID HERE**
blocks:
  - type: section
    text:
      type: mrkdwn
      text: |-
        *RTR Session Established* :rocket-intensifies: 🔍 

        Remote terminal response session successfully initiated with target endpoint `${{ TRIGGER.Hostname }}` 
        (Device ID: `${{ ACTIONS.validate_device_for_collection.result.device_id }})` at `${{ ACTIONS.initialise_rtr_session.result.headers.Date }}`.        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: |-
        *Session Details:*
        • Platform: macOS :macOS-dark: 
        • Case ID: `${{ ACTIONS.create_case.result.case_number }}`

        Chain of custody initiated for Chrome :chrome: browser history collection.        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: |-
        *🔗 Quick Actions:*
        • <https://XXX.tracecat.com/workspaces/XXX/cases|*View Case Details*> - Review collected evidence
        • <https://XXXXX.CrowdStrike.com/real-time-response/sessions/audit-logs|*RTR Audit Logs*> - View session activity        

operation_id: BatchCmd
params:
  body:
    base_command: ls
    command_string: ls /Users/
    batch_id: ${{ ACTIONS.extract_session_information.result.batch_id }}
    session_id: ${{ ACTIONS.extract_session_information.result.session_id }}

script: |
  def main(batch_response):
      """
      Parses /Users/ directory listing to identify legitimate user accounts.
      Filters out system directories and administrative accounts.
      
      Args:
          batch_response: RTR BatchCmd response from 'ls /Users/' command
          
      Returns:
          List of regular users with primary_user selected for Chrome collection
      """
      
      # ============================================================================
      # EXTRACT RESPONSE RESOURCES
      # ============================================================================
      # Why: RTR batch commands nest results in body.combined.resources
      # How: Navigate through the nested structure to access command output
      combined = batch_response.get("body", {}).get("combined", {})
      resources = combined.get("resources", {})
      
      if not resources:
          return {
              "success": False,
              "error": "No resources returned from user discovery command"
          }
      
      # ============================================================================
      # DYNAMIC DEVICE ID EXTRACTION
      # ============================================================================
      # Why: Device IDs vary per endpoint - can't hardcode the key name
      # How: Get the first (and only) device from the resources dictionary
      device_id = list(resources.keys())[0]
      device_result = resources[device_id]
      
      # ============================================================================
      # COMMAND COMPLETION VALIDATION
      # ============================================================================
      # Why: Ensure the 'ls /Users/' command actually finished executing
      # How: Check the 'complete' flag returned by RTR
      if not device_result.get("complete"):
          return {
              "success": False,
              "error": "User discovery command did not complete"
          }
      
      # ============================================================================
      # STDOUT OUTPUT VALIDATION
      # ============================================================================
      # Why: Need actual directory listing data to parse users
      # How: Extract stdout and verify it's not empty
      stdout = device_result.get("stdout", "")
      if not stdout:
          return {
              "success": False,
              "error": "No output from user discovery command"
          }
      
      # ============================================================================
      # PARSE DIRECTORY LISTING
      # ============================================================================
      # Why: stdout contains space-separated list of directories from /Users/
      # How: Split on whitespace to get individual directory names
      all_items = stdout.strip().split()
      
      # ============================================================================
      # SYSTEM ACCOUNT FILTERING - HARDCODED EXCLUSIONS
      # ============================================================================
      # Why: /Users/ contains system directories that aren't actual user accounts
      # How: Define a set of known macOS system directories and admin accounts
      ignore_items = {
          '.localized',   # macOS localization metadata directory
          'Shared',       # Shared user files directory
          'Guest',        # Guest account (temporary, no persistent data)
          '.DS_Store',    # macOS metadata file (shouldn't appear but just in case)
          'admin',        # Common administrative account name
          'administrator',# Windows-style admin account sometimes present
          'root'          # System root user (should never be in /Users/ but filter anyway)
      }
      
      # ============================================================================
      # MULTI-LAYER USER FILTERING
      # ============================================================================
      # Why: Need to identify legitimate human users, not system/service accounts
      # How: Apply multiple filters to catch different types of non-user accounts
      regular_users = []
      for item in all_items:
          # Filter 1: Not in hardcoded ignore list
          # Filter 2: Doesn't start with _ (macOS system accounts like _spotlight, _windowserver)
          # Filter 3: Doesn't contain 'admin' (case-insensitive - catches Admin, sysadmin, etc.)
          # Filter 4: Not a system daemon account (daemon, nobody, root as fallback)
          if (item not in ignore_items and 
              not item.startswith('_') and 
              'admin' not in item.lower() and 
              item not in ['daemon', 'nobody', 'root']):
              regular_users.append(item)
      
      # ============================================================================
      # VALIDATE RESULTS
      # ============================================================================
      # Why: Ensure we found at least one legitimate user to collect from
      # How: Check if filtering left us with any users
      if not regular_users:
          return {
              "success": False,
              "error": "No regular user accounts found on system"
          }
      
      # ============================================================================
      # RETURN PARSED USER DATA
      # ============================================================================
      # Why: Provide structured data for Chrome history collection
      # How: Select first user as primary (alphabetically first = often device owner)
      return {
          "success": True,
          "primary_user": regular_users[0],    # First user selected for collection
          "all_users": regular_users,          # Full list for documentation
          "user_count": len(regular_users),    # Count for validation/logging
          "device_id": device_id               # Preserve device ID for tracking
      }

inputs:
  batch_response: ${{ ACTIONS.list_users_on_the_host_device.result }}

case_id: ${{ ACTIONS.create_case.result.id }}
content: "User Account Discovery - Identified ${{ ACTIONS.parse_user_results.result.user_count }} regular user account(s) on target system. Primary user for collection: '${{ ACTIONS.parse_user_results.result.primary_user }}'. System accounts filtered from scope."

${{ ACTIONS.extract_session_information.result.status_code == 201 }}

channel: **ADD YOUR SLACK CHANNEL ID HERE**
blocks:
  - type: section
    text:
      type: mrkdwn
      text: |-
        👤 *User Account Discovery Complete*

        Identified ${{ ACTIONS.parse_user_results.result.user_count }} regular user account(s) on target system.        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: |-
        *Primary User:* '${{ ACTIONS.parse_user_results.result.primary_user }}'
        *Case ID:* ${{ ACTIONS.create_case.result.case_number }}

        System accounts filtered from scope.        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: |-
        *🔗 Quick Actions:*
        • <https://X.tracecat.com/workspaces/X/cases|*View Case Details*> - Review collected evidence
        • <https://X.CrowdStrike.com/real-time-response/sessions/audit-logs|*RTR Audit Logs*> - View session activity        

ls "/Users/jdoe/Library/Application Support/Google/Chrome"/*/History
                                                          ^^
                                                        Wildcard matches
                                                        any profile folder

operation_id: BatchAdminCmd
params:
  body:
    base_command: ls
    command_string: ls "/Users/${{ ACTIONS.parse_user_results.result.primary_user }}/Library/Application Support/Google/Chrome"/*/History
    batch_id: ${{ ACTIONS.extract_session_information.result.batch_id }}
    session_id: ${{ ACTIONS.extract_session_information.result.session_id }}

${{ ACTIONS.parse_user_results.result.success == True && ACTIONS.parse_user_results.result.user_count > 0 }}

script: |
  def main(discovery_response, username):
      """
      Parses Chrome profile discovery results to extract History file paths.
      Organizes discovered files by profile name for structured collection.
      
      Args:
          discovery_response: RTR BatchAdminCmd response from Chrome discovery ls command
          username: The primary user whose Chrome profiles are being discovered
          
      Returns:
          Structured list of Chrome History files with profile names and paths
      """
      
      # ============================================================================
      # EXTRACT RESPONSE RESOURCES
      # ============================================================================
      # Why: RTR batch commands nest results in body.combined.resources
      # How: Navigate through the nested structure to access command output
      combined = discovery_response.get("body", {}).get("combined", {})
      resources = combined.get("resources", {})
      
      if not resources:
          return {
              "success": False,
              "error": f"No Chrome history files found for user {username}"
          }
      
      # ============================================================================
      # DYNAMIC DEVICE ID EXTRACTION
      # ============================================================================
      # Why: Device IDs are unique per endpoint - can't hardcode
      # How: Get the first (and only) device from resources dictionary
      device_id = list(resources.keys())[0]
      device_result = resources[device_id]
      
      # ============================================================================
      # COMMAND COMPLETION VALIDATION
      # ============================================================================
      # Why: Ensure the Chrome discovery ls command actually finished
      # How: Check the 'complete' flag returned by RTR
      if not device_result.get("complete"):
          return {
              "success": False,
              "error": "Chrome history discovery did not complete"
          }
      
      # ============================================================================
      # EXTRACT COMMAND OUTPUT
      # ============================================================================
      # Why: Need both stdout (successful file listings) and stderr (error messages)
      # How: Get both streams to handle success and failure cases
      stdout = device_result.get("stdout", "")
      stderr = device_result.get("stderr", "")
      
      # ============================================================================
      # ERROR DETECTION - CHROME NOT INSTALLED
      # ============================================================================
      # Why: If Chrome isn't installed, ls returns "No such file or directory"
      # How: Check stderr for this specific error message
      if stderr and "No such file or directory" in stderr:
          return {
              "success": False,
              "error": f"Chrome not installed or no history files found for user {username}"
          }
      
      # ============================================================================
      # STDOUT VALIDATION
      # ============================================================================
      # Why: If Chrome exists but has no profiles/history, stdout will be empty
      # How: Check if we got any output at all
      if not stdout:
          return {
              "success": False,
              "error": f"No Chrome history files found for user {username}"
          }
      
      # ============================================================================
      # PARSE FILE PATHS LINE-BY-LINE
      # ============================================================================
      # Why: stdout contains one file path per line from the wildcard ls command
      # How: Split by newlines and process each path individually
      # Example stdout:
      #   /Users/jdoe/.../Chrome/Default/History
      #   /Users/jdoe/.../Chrome/Profile 1/History
      history_files = []
      for line in stdout.strip().split('\n'):
          # Filter: Only process non-empty lines containing 'History'
          if line.strip() and 'History' in line:
              # ================================================================
              # PROFILE NAME EXTRACTION
              # ================================================================
              # Why: Need to identify which Chrome profile each History file belongs to
              # How: Split path by '/' and get the directory name before "History"
              # Example: /Users/jdoe/.../Chrome/Profile 1/History
              #          path_parts[-2] = "Profile 1"
              #          path_parts[-1] = "History"
              path_parts = line.split('/')
              profile_name = path_parts[-2]  # Get the directory name before "History"
              
              # ================================================================
              # BUILD STRUCTURED FILE INFO
              # ================================================================
              # Why: Create organized data structure for downstream file operations
              # How: Store profile name, full path, and relative path for evidence naming
              history_files.append({
                  "profile_name": profile_name,           # e.g., "Default", "Profile 1"
                  "history_path": line.strip(),           # Full source path for copying
                  "relative_path": f"Chrome/{profile_name}/History"  # Organized output path
              })
      
      # ============================================================================
      # VALIDATE PARSED RESULTS
      # ============================================================================
      # Why: Ensure we successfully parsed at least one valid History file path
      # How: Check if our parsing loop found any matches
      if not history_files:
          return {
              "success": False,
              "error": f"No valid Chrome history files found for user {username}"
          }
      
      # ============================================================================
      # RETURN STRUCTURED DISCOVERY RESULTS
      # ============================================================================
      # Why: Provide organized data for hash generation and file copying
      # How: Return list of all discovered profiles with metadata
      return {
          "success": True,
          "username": username,                    # Preserve username for documentation
          "history_file_count": len(history_files),  # Count for validation
          "history_files": history_files           # List of all profiles found
      }

inputs:
  discovery_response: ${{ ACTIONS.check_chrome_installation.result }}
  username: ${{ ACTIONS.parse_user_results.result.primary_user }}

case_id: ${{ ACTIONS.create_case.result.id }}
content: "Browser Evidence Located - Chrome installation confirmed for user '${{ ACTIONS.parse_all_chrome_history_files_found.result.username }}'. Discovered ${{ ACTIONS.parse_all_chrome_history_files_found.result.history_file_count }} Chrome profile(s) with history files. Evidence preservation initiated."

${{ ACTIONS.parse_user_results.result.success == True && ACTIONS.parse_user_results.result.user_count > 0 }}

channel: **ADD YOUR SLACK CHANNEL ID HERE**
blocks:
  - type: section
    text:
      type: mrkdwn
      text: |-
        🌐 *Browser Evidence Located* :file_folder:

        :chrome: Chrome installation confirmed for user '${{ ACTIONS.parse_all_chrome_history_files_found.result.username }}'.        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: |-
        *Evidence Found:*
        • `${{ ACTIONS.parse_all_chrome_history_files_found.result.history_file_count }}` Chrome profile(s) with history files
        • Case ID: `${{ ACTIONS.create_case.result.case_number }}`

        Evidence preservation initiated.        
  - type: divider
  - type: section
    text:
      type: mrkdwn
      text: |-
        *🔗 Quick Actions:*
        • <https://X.tracecat.com/workspaces/X/cases|*View Case Details*> - Review collected evidence
        • <https://X.CrowdStrike.com/real-time-response/sessions/audit-logs|*RTR Audit Logs*> - View session activity