Jumplists osquery table
- Dominant language
- No language data
- Stars
- 6
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
**Value proposition**
Expose Windows Jump Lists artifacts (Automatic Destinations and Custom Destinations) directly within Elastic Security through an Elastic osquery extension, enabling remote, scalable, and centralized forensic analysis.
Jump Lists are a critical DFIR artifact for reconstructing user activity (recent files, application usage, execution patterns), but today they require manual collection or external tooling. This feature brings that visibility natively into the Elastic ecosystem, reducing investigation time and eliminating the need for endpoint access.
**Expected outcome**
- Analysts can run live queries and scheduled packs over jumplists across hosts via Osquery Manager in Kibana. 
- Data is normalized to ECS fields where possible (timestamp, user, host, file path, file hash) enabling seamless correlation with other telemetry.
**Optional: Key user stories / use cases**
- As a forensic analyst, I want to reconstruct user activity timelines based on recently accessed files and applications.
- As a SOC analyst, I want to identify suspicious file access (e.g., staging tools, archives, scripts) without accessing the endpoint directly.
- As an incident responder, I want to correlate Jump Lists with other artifacts (e.g., Amcache, Prefetch) to understand attacker behavior.
- As a threat hunter, I want to query Jump Lists across endpoints to identify abnormal usage patterns at scale.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.