# Plaso parser and parser plugin presets.
---
name: android
description: Preset for Android.
parsers:
- android_app_usage
- chrome_cache
- filestat
- sqlite/android_app_usage
- sqlite/android_calls
- sqlite/android_sms
- sqlite/android_turbo
- sqlite/android_webview
- sqlite/android_webviewcache
- sqlite/chrome_8_history
- sqlite/chrome_17_cookies
- sqlite/chrome_27_history
- sqlite/chrome_66_cookies
- sqlite/skype
---
name: atlassian
description: Preset for Atlassian Data Center and Server products (Confluence, Jira).
parsers:
- text/atlassian_confluence
- text/atlassian_jira
- text/confluence_access
- text/jira_access
---
name: ios
description: Preset for iOS.
parsers:
- jsonl/ios_application_privacy
- plist/ios_identityservices
- sqlite/imessage
- sqlite/ios_netusage
- sqlite/ios_powerlog
- sqlite/ios_screentime
- sqlite/kik_ios
- sqlite/twitter_ios
- text/ios_lockdownd
- text/ios_logd
- text/ios_sysdiag_log
---
name: linux
description: Preset for Linux.
operating_systems:
- {family: Linux}
parsers:
- bencode
- czip/oxml
- jsonl/docker_container_config
- jsonl/docker_container_log
- jsonl/docker_layer_config
- filestat
- olecf
- pls_recall
- sqlite/google_drive
- sqlite/skype
- sqlite/zeitgeist
- systemd_journal
- text/apt_history
- text/bash_history
- text/dpkg
- text/gdrive_synclog
- text/googlelog
- text/popularity_contest
- text/selinux
- text/syslog
- text/syslog_traditional
- text/vsftpd
- text/xchatlog
- text/xchatscrollback
- text/zsh_extended_history
- utmp
- webhist
---
name: macos
description: Preset for MacOS.
operating_systems:
- {family: MacOS}
parsers:
- asl_log
- bencode
- bsm_log
- cups_ipp
- czip/oxml
- filestat
- fseventsd
- mac_keychain
- olecf
- plist
- spotlight_storedb
- sqlite/appusage
- sqlite/google_drive
- sqlite/imessage
- sqlite/ls_quarantine
- sqlite/mac_document_versions
- sqlite/mac_notes
- sqlite/mackeeper_cache
- sqlite/mac_knowledgec
- sqlite/skype
- text/bash_history
- text/gdrive_synclog
- text/mac_appfirewall_log
- text/mac_securityd
- text/mac_wifi
- text/macos_launchd_log
- text/syslog
- text/syslog_traditional
- text/zsh_extended_history
- utmpx
- webhist
---
name: mactime
description: Backwards compatibility for mactime parser.
deprecated: true
parsers:
- bodyfile
---
name: webhist
description: Preset for Web history.
parsers:
- binary_cookies
- chrome_cache
- chrome_preferences
- esedb/msie_webcache
- firefox_cache
- java_idx
- msiecf
- opera_global
- opera_typed_history
- plist/safari_history
- sqlite/chrome_8_history
- sqlite/chrome_17_cookies
- sqlite/chrome_27_history
- sqlite/chrome_66_cookies
- sqlite/chrome_autofill
- sqlite/chrome_extension_activity
- sqlite/firefox_2_cookies
- sqlite/firefox_10_cookies
- sqlite/firefox_downloads
- sqlite/firefox_history
- sqlite/safari_historydb
---
name: win_gen
description: Preset for generic Windows, intended as template for other Windows presets.
parsers:
- bencode
- czip/oxml
- filestat
- lnk
- mcafee_protection
- olecf
- pe
- prefetch
- sqlite/google_drive
- sqlite/skype
- symantec_scanlog
- text/gdrive_synclog
- text/sccm
- text/setupapi
- text/skydrive_log_v1
- text/skydrive_log_v2
- text/teamviewer_application_log
- text/teamviewer_connections_incoming
- text/teamviewer_connections_outgoing
- text/winfirewall
- usnjrnl
- webhist
- winjob
- winreg
---
name: win7
description: Preset for generic Windows, intended for Windows Vista and later.
operating_systems:
- {family: Windows NT}
parsers:
- custom_destinations
- esedb/file_history
- esedb/user_access_logging
- olecf/olecf_automatic_destinations
- recycle_bin
- text/powershell_transcript
- winevtx
- win_gen
- winpca_db0
- winpca_dic
---
name: win7_slow
description: Preset for Windows 7 and later including parsers that require more processing time.
parsers:
- esedb
- mft
- win7
---
name: winxp
description: Preset for Windows 2000, Windows XP and Windows 2003.
operating_systems:
- {product: Windows 2000}
- {product: Windows XP}
- {product: Windows 2003}
parsers:
- recycle_bin_info2
- rplog
- win_gen
- winevt
---
name: winxp_slow
description: Preset for Windows XP and 2003 including parsers that require more processing time.
parsers:
- esedb
- mft
- winxp
