Search Web History on Clients

GabeShack
Valued Contributor III

So we recently had someone printout some documents that seemed slightly questionable and I am looking for a way to see what computer may have been on a specific website by searching web history. Anyone know of a way to search web history for Safari/Firefox/Chrome? I have it narrowed down to a small group of computers but would rather know if they went to this specific website for sure. I could go through the content filter/firewall but thought this would be easier.

Gabe Shackney
Princeton Public Schools

Gabe Shackney
Princeton Public Schools
1 ACCEPTED SOLUTION

mm2270
Legendary Contributor III

I'm not sure if I would bother with this unless I was directed to by management.
For one, its not the easiest thing to pull all the browser history, at least not for all the browsers listed. For another, its trivially easy for someone to delete their browsing history, which means it won't show up in any results.

Anyway, you'd have to figure out how to actually report on it. You could do something like run a Casper Remote run command against the target Macs to get some immediate results back I guess.

If you really want to do this, here's a simple line that should print the sites from your own Safari browser history and only show any with "apple.com" in them. You'd have to make this work for other accounts.

defaults read ~/Library/Safari/History.plist | grep '""' | awk -F'"' '{print $4}' | grep "apple.com"

There are likely much better ways of doing this, like looking at this through your schools content filter.

View solution in original post

2 REPLIES 2

mm2270
Legendary Contributor III

I'm not sure if I would bother with this unless I was directed to by management.
For one, its not the easiest thing to pull all the browser history, at least not for all the browsers listed. For another, its trivially easy for someone to delete their browsing history, which means it won't show up in any results.

Anyway, you'd have to figure out how to actually report on it. You could do something like run a Casper Remote run command against the target Macs to get some immediate results back I guess.

If you really want to do this, here's a simple line that should print the sites from your own Safari browser history and only show any with "apple.com" in them. You'd have to make this work for other accounts.

defaults read ~/Library/Safari/History.plist | grep '""' | awk -F'"' '{print $4}' | grep "apple.com"

There are likely much better ways of doing this, like looking at this through your schools content filter.

GabeShack
Valued Contributor III

Thanks for that...management is already pulling the trigger on this so I can scope to my small group and perhaps make this an extension attribute or something.

Gabe Shackney
Princeton Public Schools

Gabe Shackney
Princeton Public Schools