elastic / elastic/roadmap

Jumplists osquery table

Open
#246 0 comments 0 reactions 1 assignee Claimed by @raqueltabuyo View on GitHub
Component: Elastic Cloud Hosted Component: Elastic Cloud Serverless product-area:security
Dominant language
No language data
Stars
6
Forks
1
PR merge metrics
No merged PRs in 30d

Description

**Value proposition**
Expose Windows Jump Lists artifacts (Automatic Destinations and Custom Destinations) directly within Elastic Security through an Elastic osquery extension, enabling remote, scalable, and centralized forensic analysis.

Jump Lists are a critical DFIR artifact for reconstructing user activity (recent files, application usage, execution patterns), but today they require manual collection or external tooling. This feature brings that visibility natively into the Elastic ecosystem, reducing investigation time and eliminating the need for endpoint access.

**Expected outcome**

- Analysts can run live queries and scheduled packs over jumplists across hosts via Osquery Manager in Kibana. 
- Data is normalized to ECS fields where possible (timestamp, user, host, file path, file hash) enabling seamless correlation with other telemetry.

**Optional: Key user stories / use cases**

- As a forensic analyst, I want to reconstruct user activity timelines based on recently accessed files and applications.
- As a SOC analyst, I want to identify suspicious file access (e.g., staging tools, archives, scripts) without accessing the endpoint directly.
- As an incident responder, I want to correlate Jump Lists with other artifacts (e.g., Amcache, Prefetch) to understand attacker behavior.
- As a threat hunter, I want to query Jump Lists across endpoints to identify abnormal usage patterns at scale.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.