# Defender browser-extension data — licensing notes

Review the source's licensing dependency for the Defender browser-extension table and its example hunting query. The notes are a feature-gap assessment, not confirmation of a purchased entitlement.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

## Missing "Add-on MS Defender Vulnerability Management"

SUMMARY: \*\*Will give us the Browser Extensions Table(DeviceTvmBrowserExtensions) in Advanced Hunting

The "Microsoft Defender Vulnerability Management"\*\* Add-on license will allow us to see all browserExtensions on all devices from the **DeviceTvmBrowserExtensions** table in Advanced Hunting in Defender.

### Query conditional on the recorded licensing dependency

The source proposes the following KQL to list browser extensions if the licensing dependency is met.

This KQL example looks for all devices that are trying to access yandex.ru and then gets the browser extensions for all of those devices.

// 1. Devices making calls to yandex.ru from browsers (last 7 days)

let yandexDevices = DeviceNetworkEvents

\| where Timestamp \> ago(7d)

\| where RemoteUrl contains "yandex.ru"

\| where InitiatingProcessName in ("chrome.exe", "msedge.exe", "firefox.exe")

\| distinct DeviceId, DeviceName, AccountName;

// 2. Show ALL extensions on those devices

DeviceTvmBrowserExtensions

\| where DeviceId in (yandexDevices)

\| join kind=inner yandexDevices on DeviceId

\| project DeviceName, AccountName, BrowserName, ExtensionName, ExtensionId, ExtensionVersion, IsEnabled, ExtensionRisk, Permissions

\| order by DeviceName, BrowserName, ExtensionRisk desc

### WITHOUT THE LICENSE

You have to hack your way around it. Currently attempting with this Remediation script to return some data on the extensions.

[CCMCO: Collect List of Browser Extensions - Intune Remediation](https://intune.microsoft.com/#view/Microsoft_Intune_Enrollment/UXAnalyticsScriptMenu/~/deviceStatus/id/4ecd22c7-7774-4e1a-a03d-190303142cf0/scriptName/CCMCO%253A%2520Collect%2520List%2520of%2520Browser%2520Extensions/isFirstParty~/false) to reduce the output the source proposes one remediation for Google Chrome and another for Internet Explorer. Alternatively you could run a script that saves the information to AzureBLOB or FTP storage.

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)