Query Details
Browser Extension Installed Extensions With Notification Permissions
Query
# Query the installed extensions with the most required permissions
----
### Defender For Endpoint
```
let ExtentionsWithNotification = DeviceTvmBrowserExtensionsKB
| where PermissionId contains "Notification"
| summarize make_set(ExtensionId) by ExtensionId;
DeviceTvmBrowserExtensions
| where ExtensionId in (ExtentionsWithNotification)
| distinct DeviceId, ExtensionName
| summarize TotalInstalledDevices = count() by ExtensionName
| sort by TotalInstalledDevices
```
Explanation
This query is used to find the installed extensions that require the most permissions. It first identifies the extensions that have the "Notification" permission, then filters the installed extensions based on those identified. It then retrieves the distinct device IDs and extension names for those installed extensions. Finally, it summarizes the count of installed devices for each extension and sorts the results based on the total number of installed devices.
Details
Bert-Jan Pals
Released: March 17, 2023
Tables
DeviceTvmBrowserExtensionsKBDeviceTvmBrowserExtensions
Keywords
Installed,Extensions,Required,Permissions
Operators
letwherecontainssummarizemake_setbyindistinctsummarizecountsort