Add Biome NotifcationUsage artifact

[thysvanmeurs]

Hello!

This script parses the Notification Usage biome. It is a first version, I expect more to come as I will continue to validate the fields further. I did not want to sit on the script for too long, but rather share it with the rest of the community.

[abrignoni]

Thanks for this, Thijs — nice work on the SEGB/protobuf decode, and thanks for sharing the first pass rather than sitting on it. To line it up with the current Biome artifacts I've bundled the changes into a single commit-able suggestion below (one click replaces the file).

Main changes

• Context form (def get_biomeNotificationUsage(context):) — the other 22 Biome artifacts all use it.
• Store timestamps as UTC. The Context form has no timezone_offset, webkit_timestampsconv already returns tz-aware UTC, and the LAVA viewer applies the selected zone — so convert_utc_human_to_timezone is dropped (otherwise Timestamp ends up in local time while SEGB Timestamp stays UTC, and it double-offsets in LAVA once the column is typed).
• data_headers: both timestamps as nested ('name', 'datetime') tuples. As written the flat 'datetime' became its own column and neither timestamp was datetime-typed.
• Path casing biome → Biome. Matching is case-sensitive (os.path.normcase is a no-op off Windows) and the real path is …/Library/Biome/streams/…, so the lowercase glob wouldn't hit a normal extraction.
• Guard the protobuf reads with .get() — a KeyError on protostuff['2']/['14'] isn't caught by the except ValueError and would crash the artifact.
• print(...) → logfunc(...).

I tested the result locally: it compiles, registers as Biome - Notification Usage, and resolves as the Context form. One thing worth a quick confirm against a real image is the Biome casing — I went with capital to match the documented path and the 21 sibling artifacts. Thanks again for contributing! 🙏

[thysvanmeurs]

Dear mr. Brignoni,

Thank you for your quick reply and thorough feedback! I have approved the changes and it is ready to merge.

[abrignoni]

Thank you, Thijs! 🙏 Really appreciate you sharing this with the community early instead of sitting on it — a brand new Biome stream (Notification.Usage) that nothing else parses yet. Merging it in.

A couple of friendly notes for whenever you pick this back up (no rush, totally fine as a first version):

• Deleted records: right now the parser only keeps EntryState.Written entries. The sibling biomeNotificationsPub.py also handles the EntryState.Deleted branch (appending the row with null fields), which recovers deleted notification usage — often the most interesting stuff for us forensically. Adding that would also give your "SEGB State" column something to show beyond "Written." 🙂
• Metadata keys: most of the Biome family now uses creation_date/last_update_date (and an artifact_icon) rather than version/date — worth aligning on the next pass for consistency.

Neither is a blocker. Excellent contribution and looking forward to the field validation you mentioned. Thanks again! 👏