Integration briefHow extensions get reported
SentinelOne does not inventory browser extensions. Its application inventory reads the Windows registry, macOS Spotlight and Linux package managers, and extensions appear in none of them. Something has to go and look, and choosing what is the only real decision in this integration.
You run the collector
RecommendedConnect, then generate the collector in the dashboard: PowerShell and bash, with your ingest URL and key already in it. Ship it however you ship scripts - RemoteOps yourself, Intune, Jamf, GPO, any RMM - and it reports straight to us.
We run it via RemoteOps
Hands-offWe upload the same collector to your script library and run it fleet-wide once a day, picking up results as agents come back online. Nothing for your endpoint team to package or schedule.
| You run it | We run it | |
|---|---|---|
| Credential we hold | A write-only key that can submit inventory for your org and nothing else. Rotate or revoke it in the dashboard. | Your Service User token, plus RemoteOps upload and run |
| Worst case if we are breached | Someone posts false inventory to your dashboard | Someone executes a script on your fleet |
| RemoteOps add-on | Not needed | Required, and billable |
| Cadence | Whatever schedule you deploy it on | Daily fleet run, collected as agents reconnect |
What the collector does
Same script either way, and you get it as plain text, so read it before you run it. It reads extension directories, the one preference field that says whether an extension is enabled, Firefox extensions.json and macOS Safari. Run it as SYSTEM or root and it walks every user profile on the machine; run it as a user and you get that user's. It writes nothing, installs nothing and leaves nothing running: it prints one line of JSON and exits.
{"v":1,"results":[
{"b":"chrome","u":"jsmith","p":"Default",
"i":"cjpalhdlnbpafiamejdnhcphjbkeiagm","x":"1.63.2"},
{"b":"edge","u":"jsmith","p":"Profile 1",
"i":"nngceckbapebfimnlniiiahkandclblb","x":"3.5.1","d":true}
],"errors":[]}Everything else
- In - We read your agent list hourly, so endpoints with an agent but no extension visibility show up as a gap.
- Out - Extensions on your fleet we have flagged malicious or rated high or critical land in Threat Intelligence as URL indicators, all tagged with our source so you can purge them in one filter.
- Never - The role we ask for holds four permissions out of roughly sixty and not one endpoint action. We cannot isolate, reboot, kill or quarantine anything.
Setup is a least-privilege role, a Service User on it, and pasting the token into the dashboard. Disconnect there and we forget it, or delete the Service User and it dies immediately without our involvement.
Whichever credential you give us is encrypted at rest, and our database has no public endpoint at all - no host, no port, no connection string, reachable only through a binding held by our own infrastructure. There is nothing to connect to even with a stolen credential.
Hosting and the rest of our posture are on our security page. Anything else, ask an engineer.
SentinelOne, Singularity and the SentinelOne logo are trademarks of SentinelOne, Inc. Used for identification only; this integration is built by Am I Being Pwned.