KQL Search

Query Details

Query the installed extensions with the most required permissions

Browser Extension Installed Extensions With Notification Permissions

Query

let ExtentionsWithNotification = DeviceTvmBrowserExtensionsKB
     | where PermissionId contains "Notification"
     | summarize make_set(ExtensionId) by ExtensionId;
DeviceTvmBrowserExtensions
| where ExtensionId in (ExtentionsWithNotification)
| distinct DeviceId, ExtensionName
| summarize TotalInstalledDevices = count() by ExtensionName
| sort by TotalInstalledDevices

About this query

Query the installed extensions with the most required permissions

Defender XDR

Explanation

This query is designed to identify browser extensions that require notification permissions and determine how widely they are installed across devices. Here's a simple breakdown of what it does:

  1. Identify Extensions with Notification Permissions:

    • The query first looks into a dataset called DeviceTvmBrowserExtensionsKB to find extensions that have permissions related to notifications. It collects the unique identifiers (ExtensionId) of these extensions.

  2. Filter Extensions:

    • It then filters another dataset, DeviceTvmBrowserExtensions, to include only those extensions identified in the first step (those with notification permissions).

  3. List Unique Extensions per Device:

    • For each device, it lists the unique extensions that match the criteria.

  4. Count Installations:

    • Finally, it counts how many devices have each of these extensions installed and sorts the results by the total number of installations.

In summary, the query finds browser extensions that require notification permissions and ranks them by how many devices they are installed on.

Details

Bert-Jan Pals profile picture

Bert-Jan Pals

Released: December 1, 2024

Tables

DeviceTvmBrowserExtensionsKBDeviceTvmBrowserExtensions

Keywords

DeviceExtensionsPermissions

Operators

letcontainssummarizemake_setbyindistinctcountsort by

Actions

GitHub