Detect Installed Chrome Extensions

[apanages]

Hello,

I wanted to reach out to the community to see how users are detecting chrome extensions that users are installing on their computers. My goal is to be able to have this data in Splunk allowing me the ability to report on the installed extensions out there in the enterprise.

Thank-you.

[mmeehanacademy]

One option would be to determine the Profile being used by the user. This can be found in "C:\Users\AppData\Local\Google\Chrome\User Data" and is usually something like 'Profile 1'. It looks like you can look at the file "Local State" in the directory "C:\Users\AppData\Local\Google\Chrome\User Data" to get a ton of configuration settings for the user, including the last active profile and also a list of profiles that exist. Below is an excerpt of my own configuration so you have an idea of what to expect.

"last_active_profiles":["Profile 1"],"last_used":"Profile 1","profiles_created":2}

So if you pull the last active profile you will have the full path to the user's extensions folder which in my case would be:

"C:\Users\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions"

You can then list the contents of this directory to get a list of extension id's. You will then need to either get a master list of all extensions from the chrome store (Not sure where you can get that) or you can just go to the chrome store and parse the webpage to get the app name. I would cache the result if you do this so you don't have to constantly hit the chrome app store.

Base URL would be https://chrome.google.com/webstore/detail/ and then you would just append the ID and read the title.

This could all probably be done in a scripted input. You could either hit the chrome web store within the scripted input and return a list of extension names or just return the list of id's and have a lookup table or function on your splunk server that handles listing the actual name of the extension.

Hope this helps point you in the right direction.

Thanks