AI Sessions
Overview
Section titled “Overview”Evidence: AI Sessions
Description: Parse AI agent transcripts to extract session timeline headers
Category: AI
Platform: linux
Short Name: aisess
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”AI coding tools persist conversation sessions as JSONL transcripts and workspace files. Session headers show when an agent ran, which project it targeted, and how many prompts or tool calls occurred.
Data Collected
Section titled “Data Collected”This collector gathers structured data about AI agent sessions, including project path, timestamps, message counts, tool-call counts, and session-level risk flags.
Collection Method
Section titled “Collection Method”This collector scans per-user transcript directories and workspace storage. JSONL transcripts are parsed for session metadata; workspace files map workspace IDs to project paths.
Forensic Value
Section titled “Forensic Value”Reconstructs the timeline of AI agent sessions: when they ran, in which projects, and how many prompts and tool calls occurred. Risk flags surface sessions with dangerous commands, prompt injection indicators, or transcript integrity gaps.