Inventory of Installed Browser Extensions Across Endpoints
The query lists installed browser (Chrome & Edge) extensions across endpoints, normalizes browser names, counts unique systems per extension, adds a Chrome Web Store link, and sorts results to highlight the most common extensions.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"
| groupBy([event_platform, BrowserName, BrowserExtensionId, BrowserExtensionName], function=([count(aid, distinct=true, as=TotalEndpoints)]))
| format("[See Extension](https://chromewebstore.google.com/detail/%s)", field=[BrowserExtensionId], as="Chrome Store Link")
| sort(order=desc, TotalEndpoints, limit=1000)
| case{
BrowserName="3" | BrowserName:="Chrome";
BrowserName="4" | BrowserName:="Edge";
*;
}Reference: GitHub CrowdStrike/logscale-community
Installed_Browser_Extensions_Across_Endpoints.yml
CrowdStrike
Hunting
Endpoint
Insight
2025-10-29
2025-10-30
