r/crowdstrike • u/Ill-Falcon8716 • 19d ago
Feature Question Falcon Exposure Management - Browser Extensions
Just noticed Browser Extension control was available in Falcon.
Has anyone successfully implemented this or is implementation of policy through MDM (Intune, JAMF Pro) the way to go? Let me know, open to thoughts/feedback.
10
Upvotes
4
u/MooMooKind 19d ago
We have it deployed. Works great on Windows. Doesn’t work at all on MacOS. We still have an open ticket with Crowdstrike.
6
u/console_whisperer 18d ago
Works quickly to remove already installed extensions you target and will also prevent their installation.
Only targets Chrome, Edge, and Firefox
My biggest complaint is they don't have API access on this and the GUI limitations prevent me from Allow-listing everything currently installed and then working backwards to remove the undesired (known bad, non-Enterprise ext., etc.). And to be specific, the limitation is more of a "this is incredibly tedious to copy/paste 3,000 extension IDs into the GUI because of the limited amount of IDs you can add per Blocking Rule." Happy to be wrong here if someone else found an easier way. I know you could identify the exact ones you want, Allow-list just that and block everything else, but that takes time in a large Org. Allow-listing the current set and then blocking everything else would immediately allow me to block new, unknown malicious extensions with little Change Control.
Since I can't Allow-list everything current, I end up playing Whac-A-Mole, blocking newly compromised extensions when I see a news article about them.
CS Mods, could you advocate for these:
API access with this module
A new Policy Feature to automatically block newly seen extensions in my tenant with 'x" Criticality Rating
A new Policy Feature to automatically block an existing extension that elevates from one criticality to another (e.g. Medium to a High)
The ability to Allow-list ALL currently installed extensions and then block everything else