Extensions & IDE plugins

Voir le Markdown

Plan requirement: Enterprise. Administrators make decisions; any member can view the inventory.

Orthalon records which browser extensions and IDE plugins are installed and what they declare: identifiers, versions, publishers, requested permissions, host access and declared capabilities. It never records page content, keystrokes, file contents or local paths, and this inventory is stored apart from AI activity events. It does not inspect what an extension does at run time.

Open Discovery → Extensions & IDE plugins.

---

1. Discovery sources

Each item shows the sources that report it. A source that has not reported for three days is marked stale.

Every connector syncs when an administrator clicks Sync. In the nightly maintenance window Orthalon also syncs Chrome Enterprise connectors that use a service account (a pasted access token has expired by then) and Microsoft Entra connectors with Defender browser extensions turned on. Desktop agents report once a day.

Chrome Enterprise (service account, recommended)

A pasted access token expires within an hour, so drift detection needs a service account:

1. In Google Cloud, enable the Chrome Management API and create a service account with a JSON key.
2. In the Google Admin console, open Security → Access and data control → API controls → Manage domain-wide delegation, add the service account's client ID, and authorize:
   • https://www.googleapis.com/auth/chrome.management.reports.readonly (installed extensions)
   • https://www.googleapis.com/auth/chrome.management.appdetails.readonly (store listing details)
   • https://www.googleapis.com/auth/chrome.management.securityinsights.readonly (suspicious URL domains; optional — without it the connector reports the gap and still imports extensions)
   • https://www.googleapis.com/auth/chrome.management.policy — only if you enable Allow blocking in a Google org unit
3. The delegated admin needs Services → Chrome Management → View Extensions List Report for the inventory. Google does not document the privilege for App Details in the pages we could check; a super administrator works. Blocking also needs privileges to manage Chrome user settings.
4. In Orthalon, enter the customer ID (my_customer works), service-account email, private key and delegated admin.

Each sync reads up to 200 pages of 100 installed apps (20,000 extensions); a larger tenant is marked partial. countInstalledApps does not return installed versions. The version Orthalon shows for a Chrome extension comes from Defender or is the latest store version, labelled as such.

Microsoft Defender browser extensions

1. On the Microsoft Entra connector's app registration, add the Microsoft Graph application permission ThreatHunting.Read.All and grant admin consent.
2. Set Read Defender browser-extension inventory to Yes.

This reads the DeviceTvmBrowserExtensions and DeviceTvmBrowserExtensionsKB advanced-hunting tables, which need Defender Vulnerability Management (the premium add-on or standalone). Microsoft Sentinel does not hold these tables. The query is summarised to one row per extension and capped at 5,000 extensions with up to 40 permission descriptions each; a capped result is marked partial and nothing is treated as removed.

Desktop agents (IDE plugins)

Turn on Collect IDE plugin metadata from enrolled desktop agents. Agents ask once a day whether collection is on, and send nothing until it is. To exclude one machine, set ORTHALON_IDE_PLUGIN_INVENTORY=off in its managed configuration.

The agent reads only extensions.json, each extension's package.json and each JetBrains plugin's META-INF/plugin.xml. It reports the id, name, publisher, version and declared capability kinds (activation such as start-up, contribution points such as terminal, chat participants, language-model tools and MCP servers, proposed APIs, untrusted-workspace support). It does not read settings, extension storage or workspace files, does not follow links out of the extensions folder, and does not report paths. Plugins bundled inside a JetBrains installation (for example JetBrains AI Assistant on some versions) and remote/WSL extension hosts are not seen.

---

2. AI extensions

An item is marked AI when its id is in Orthalon's catalogue of known AI assistants (Claude, ChatGPT/Codex, GitHub Copilot, Windsurf/Codeium, Continue, Cline, Roo Code, Kilo Code, Tabnine, Cody, Amazon Q, Gemini Code Assist, JetBrains AI Assistant, Monica, Merlin, Sider, MaxAI, HARPA, Perplexity, Grammarly, QuillBot, Wordtune), when its name matches a catalogued product, or when its name contains an AI keyword. The method is shown with the item. Only an id match carries the product's vendor; a name match keeps the extension's own publisher and, where the catalogue lists ids for that platform, adds the look-alike risk factor. AI items also appear in the AI asset inventory as AI extension.

---

3. Risk factors

The risk score is the sum of the factors below, capped at 100. Every factor shows the evidence that triggered it and its source. The score describes exposure, not intent: an extension is confirmed malicious only when an analyst records that verdict with a reason.

Store-listing permissions count toward risk. Chrome's third-party assessments (CRXcavator, Spin.AI, LayerX) and Defender's risk level are shown separately and are not part of the score.

---

4. Permission drift alerts

Orthalon keeps each item's permissions per source and compares every report with the last one from the same source:

• The first report is a baseline, not an alert. A new source for an existing item is its own baseline.
• Added permissions, host access or capabilities, a publisher change, or a move to a sideloaded/developer install raise one alert with the before/after versions and the added and removed entries.
• The same transition reported again — a retry, another source, or another device reaching the same version — attaches to the existing alert.
• Reductions and version updates are recorded in history without an alert.

Alerts go to the item's policy owner (set on the item). The owner or an administrator acknowledges and resolves them; every step is in the audit log.

---

5. Approval and enforcement

Administrators mark each item Approve, Mark for review or Deny. A decision is recorded, not enforced. What happens to a denied item depends on the platform:

A Chrome org-unit block applies only to managed browsers and managed profiles in that org unit. Approving an extension later does not lift a block in Google; remove it there. Merge exported ExtensionSettings entries into your existing policy rather than replacing it, and choose registry value numbers that are not already in use.