Useful Splunk SIEM Queries for Live Query - Chrome Extensions

Live Query can fetch a full list of Chrome Extensions on a daily basis to help you inventory out-of-date or malicious add-ons.

Using this query, it is probably more interesting to look at the less popular extensions that appear on only a few endpoints.

Note: Due to the 10,000 result limit per query, you might want to tune your Live Query SQL to filter out known-good extensions.

Show Least-Used Chrome Extensions, Versions, and Associated Endpoints and Users

eventtype="vmware_cbc_base_index" sourcetype="vmware:cbc:livequery:result" query_name="Chrome Extensions" status=matched
| rename device.* as device_*, fields.* as *
| stats
  values(version) as versions,
  dc(device_id) as device_count,
  values(device_name) as devices,
  values(username) as users,
  by name
| sort device_count