SentinelOne vs Am I Being Pwned
Triaging Browser Extensions with SentinelOne
SentinelOne has no dedicated browser-extension inventory or risk score - triage is a manual Data Lake query. Here's how to get an evidence-backed extension verdict instead.
Does SentinelOne inventory and triage browser extensions?
SentinelOne has no dedicated browser-extension feature. Unlike CrowdStrike or Microsoft Defender, there is no 'Browser Extension Assessment' page in the Singularity console that lists your extensions and scores them. The closest capabilities are Application Risk, which inventories installed desktop applications and matches them to CVEs from the NIST NVD, and Deep Visibility / Data Lake queries, where an analyst manually enumerates extensions and cross-references their IDs against known-bad lists.
So 'triage' with SentinelOne alone is a do-it-yourself workflow: hunt down the extensions yourself, then judge them yourself. There is no permission score, no code analysis, and no per-extension block policy out of the box. (Note: Singularity Ranger is network device discovery, and SentinelOne's own Deep Visibility browser add-on only reports the URLs a user visits - neither inventories other extensions.)
Am I Being Pwned is the productised version of what you'd otherwise build by hand: a full extension inventory across the fleet, and for each extension a keep-or-remove call. It reads the code, runs it in a sandbox, and shows what it actually did - so instead of writing a Data Lake query and interpreting the output yourself, the answer arrives with the evidence attached.
What SentinelOne gives you
- Application Risk: an inventory of installed desktop applications, matched to CVEs from the NIST NVD
- Deep Visibility / Singularity Data Lake: analysts can write custom queries to enumerate extension IDs on endpoints
- EDR behavioural detection that can act on malicious processes running on the endpoint
- A Deep Visibility browser add-on that reports visited URLs as threat telemetry
Where it stops
- There is no dedicated browser-extension inventory or assessment page
- Extensions get no permission-based or behavioural risk score
- A malicious-or-safe determination comes from the analyst, not the platform
- There is no per-extension block or allow policy to enforce
- Extension coverage is a manual, query-driven workflow, not a product feature
SentinelOne vs Am I Being Pwned
How to triage browser extensions when you use SentinelOne
SentinelOne won't hand you an extension list, so triage starts with discovery. Here's the manual path, and the shortcut.
- 1
Enumerate extensions with a Deep Visibility query
SentinelOne has no extension inventory page, so query the Data Lake for installed extension files and IDs across your endpoints. This gives you a raw list, not a risk assessment.
- 2
Cross-reference IDs against known-bad lists
Match the extension IDs against public malicious-extension lists. This catches already-known bad actors but misses anything not yet listed - which is most novel threats.
- 3
Assess the unknowns
For every extension that isn't obviously known-good or known-bad (the majority), you need to know what its code does. Paste the ID into Am I Being Pwned, or scan your whole Workspace, to get a behavioural report instead of a bare ID.
- 4
Decide with evidence and enforce
Judge each unknown on what it did, not its ID. Whitelist the ones whose behaviour matches their purpose; kill the ones caught reading credentials or phoning home. Because SentinelOne has no per-extension policy, push the blocks through your MDM - Chrome policy, Intune, Jamf, or Kandji.
- 5
Automate the re-check
Rather than re-running queries by hand, let continuous behavioural re-scanning flag extensions that turn malicious in a later update.
From our published research
“Any site with the same Country Code eTLD could exfiltrate usernames, passwords, URLs and TOTP codes from any other login on the same eTLD. No user interaction. The manifest was totally fine.”
MultiPassword - CVSS 8.3
A clean manifest that a known-bad ID list would never flag.
“Spin AI scored it 51 (medium risk) - higher than Stylish, higher than Coupert, roughly the same as the extensions we observed collecting data.”
Why Permission Scoring Fails
uBlock Origin, one of the most trusted extensions, rated mid-risk by reputation and permissions.
“We tried - 212 features, gradient boosting, everything we could extract without running the code. It explained 28% of variance on the training set and scored negative R² on validation.”
Why Permission Scoring Fails
You cannot reach a verdict from metadata; you have to run the code.
Frequently asked questions
Does SentinelOne have a browser extension inventory?
Not as a dedicated feature. SentinelOne's Application Risk inventories installed desktop applications, and analysts can enumerate browser extensions manually with Deep Visibility / Data Lake queries, but there is no built-in extension inventory or assessment page like CrowdStrike's or Microsoft Defender's.
Can SentinelOne detect malicious browser extensions?
Only indirectly. Its EDR can act on malicious processes, and an analyst can cross-reference extension IDs against known-bad lists, but SentinelOne does not analyse extension code or assign extensions a risk verdict. Novel or post-update malicious extensions won't be caught by an ID list.
Is Singularity Ranger a browser extension tool?
No. Singularity Ranger, now Singularity Network Discovery, finds unmanaged network devices. It has nothing to do with browser extensions, so don't rely on it for extension visibility.
How do I assess extension risk if I use SentinelOne?
Because SentinelOne has no native extension risk scoring, teams pair it with a dedicated tool. Am I Being Pwned inventories every extension across your fleet and returns an evidence-backed verdict from reading and running the code - the analysis SentinelOne doesn't do.
Triage every extension in your fleet, with evidence.
Free scan of your Google Workspace in under 48 hours.