Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Profile: modules/linux/bash-history.toml

Source

  • Original path: profiles/modules/linux/bash-history.toml

Profile (TOML)

# Linux Bash History Module
# Collects shell history files for command analysis

[module]
name = "Bash History Artifacts"
description = "Shell history files (bash, zsh, fish, etc.)"
category = "linux"
platform = ["linux", "macos"]
priority = "high"

# Bash History
[[patterns]]
  name = "Bash History"
  pattern = "\\.bash_history$"
  case-insensitive = true
  type = "regex"

# Zsh History
[[patterns]]
  name = "Zsh History"
  pattern = "\\.zsh_history$"
  case-insensitive = true
  type = "regex"

# Fish History
[[patterns]]
  name = "Fish History"
  pattern = "fish_history$"
  case-insensitive = true
  type = "regex"

# Sh History
[[patterns]]
  name = "Sh History"
  pattern = "\\.sh_history$"
  case-insensitive = true
  type = "regex"

# Ksh History
[[patterns]]
  name = "Ksh History"
  pattern = "\\.ksh_history$"
  case-insensitive = true
  type = "regex"

# Tcsh History
[[patterns]]
  name = "Tcsh History"
  pattern = "\\.history$"
  case-insensitive = true
  type = "regex"

# Bash Profile/RC
[[patterns]]
  name = "Bash RC"
  pattern = "\\.bashrc$"
  case-insensitive = true
  type = "regex"

[[patterns]]
  name = "Bash Profile"
  pattern = "\\.bash_profile$"
  case-insensitive = true
  type = "regex"

[[patterns]]
  name = "Bash Logout"
  pattern = "\\.bash_logout$"
  case-insensitive = true
  type = "regex"

# Zsh RC files
[[patterns]]
  name = "Zsh RC"
  pattern = "\\.zshrc$"
  case-insensitive = true
  type = "regex"

[[patterns]]
  name = "Zsh Profile"
  pattern = "\\.zprofile$"
  case-insensitive = true
  type = "regex"

# Profile
[[patterns]]
  name = "Profile"
  pattern = "\\.profile$"
  case-insensitive = true
  type = "regex"

# MySQL History
[[patterns]]
  name = "MySQL History"
  pattern = "\\.mysql_history$"
  case-insensitive = true
  type = "regex"

# Python History
[[patterns]]
  name = "Python History"
  pattern = "\\.python_history$"
  case-insensitive = true
  type = "regex"

# Node REPL History
[[patterns]]
  name = "Node REPL History"
  pattern = "\\.node_repl_history$"
  case-insensitive = true
  type = "regex"

# SQLite History
[[patterns]]
  name = "SQLite History"
  pattern = "\\.sqlite_history$"
  case-insensitive = true
  type = "regex"

# Less History
[[patterns]]
  name = "Less History"
  pattern = "\\.lesshst$"
  case-insensitive = true
  type = "regex"

# Vim Info
[[patterns]]
  name = "Vim Info"
  pattern = "\\.viminfo$"
  case-insensitive = true
  type = "regex"