The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

BrowserHistory collector

  • Published on Aug 26, 2026
  • 1 minute(s) read
Prev Next

The BrowserHistory collector shows the BrowserHistory entries of a Windows operating system.

Collector output

Field

Type

Description

url

String

URL of the visited webpage.

title

String

Title of the visited webpage.

last_visit_time

String

Time of last visit. The string represents the FILETIME structure which is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).

visit_count

int

Number of times the URL was visited.

visit_from

String

The website from which this webpage was reached.

browser

String

Name of the browser which accessed this webpage. The possible values are:

  • Google Chrome

  • Mozilla Firefox

  • Microsoft Edge

  • Microsoft Internet Explorer

user_profile

String

The user profile used to access the webpage.

browser_profile

String

The browser profile used to access the webpage.

url_length

int

The length of the URL string.

typed_count

int

The number of times the address of the webpage was typed in the browser .



Example: Show visited URLs that have the trellix.com domain
BrowserHistory where BrowserHistory url contains "trellix.com"


Hunting for indicators of attack - IoAs: http activity
BrowserHistory visit_count, url, browser
    WHERE BrowserHistory url_length greater than "255"
        AND BrowserHistory url contains "pastebin.com"