Extension Fields

Extension fields can be used in search queries and detection queries within Policies. These fields represent metadata for certain extensions, extension permissions, reputation information such as popularity and reviews, and organization-specific risk indicators provided by Keep Aware. By default, most manifest information is included by Keep Aware. To learn more about extension manifests, visit Chrome Manifest.

Getting Started

To get started using extension fields, navigate to the Events page from the menu on the left side of your console. Click the magnifying glass icon to open the search area and use the search bar to search for events and extensions with various fields. Or use the Search Builder or Filter options on the right-side of the search bar to find certain fields.

Image: Events Search Bar

Popular Fields

• extension.homepageUrl | text | The URL of the homepage of this extension, app, or theme.
• extension.id | text | The extension's unique identifier.
• extension.installType | text | How the extension was installed.
• extension.name | text | The name of this extension, app, or theme.
• extension.type | text | The type of this extension, app, or theme.

Extension Fields

• extension.bypass | boolean | Whether a notice was skipped
• extension.description | text | The description of this extension, app, or theme.
• extension.disabledReason | text | A reason the item is disabled.
• extension.enabled | boolean | Whether it is currently enabled or disabled.
• extension.homepageUrl | text | The URL of the homepage of this extension, app, or theme.
• extension.hostPermissions | text | Returns a list of host based permissions.
• extension.id | text | The extension's unique identifier.
• extension.installType | text | How the extension was installed.
• extension.isApp | boolean | Whether the extension is an app
• extension.mayDisable | boolean | Whether this extension can be disabled or uninstalled by the user.
• extension.mayEnable | boolean | Whether this extension can be enabled by the user. This is only returned for extensions which are not enabled
• extension.name | text | The name of this extension, app, or theme.
• extension.offlineEnabled | boolean | Whether the extension, app, or theme declares that it supports offline.
• extension.optionsUrl | text | The url for the item's options page, if it has one.
• extension.permissions | text | Returns a list of API based permissions.
• extension.shortName | text | A short version of the name of this extension, app, or theme.
• extension.type | text | The type of this extension, app, or theme.
• extension.updateUrl | text | The update URL of this extension, app, or theme.
• extension.version | text | The version of this extension, app, or theme.
• extension.versionName | text | The version name of this extension, app, or theme if the manifest specified one.
• hits | number | Moving window (default 3 months) of total activity for the location.
• location | text | The extension.id.
• risk.public.installs | number | The number of public installs according to the browser store. | Note: In Development
• risk.permission.count | number | The number of permissions; the length of extension.permissions.
• risk.permission.rarity_score | number | The numeric classification of risk.permission.rarity_sum into either '1' (Low), '3' (Medium), or '5' (High).
• risk.permission.rarity_sum | number | The sum of the number of permissions weighted by their comparitive rarity. The higher the sum, either the more permissions and/or the more rare of permissions.
• risk.reputation.installs | number | The total number of install events seen for that extension in your organization.

Examples

User-specific Extension Events with Specific Permission

Extensions that are linked to users named "robert" and request the permission "webRequest".

user.label:*robert* AND extension.permissions:"webRequest"

Uncommon Admin Installs

Search for extensions installed either by an admin or through registry key manipulation and are uncommon in your organization.

extension.installType:"admin" AND risk.reputation.installs:<5