| title | DeviceTvmBrowserExtensions table in the advanced hunting schema | ||
|---|---|---|---|
| description | Learn about browser extension installations found on devices as shown in Microsoft Defender Vulnerability Management. | ||
| search.appverid | met150 | ||
| ms.service | defender-xdr | ||
| ms.subservice | adv-hunting | ||
| f1.keywords |
|
||
| ms.author | pauloliveria | ||
| author | poliveria | ||
| ms.localizationpriority | medium | ||
| manager | dansimp | ||
| audience | ITPro | ||
| ms.collection |
|
||
| ms.custom |
|
||
| appliesto |
|
||
| ms.topic | reference | ||
| ms.date | 03/28/2025 |
[!INCLUDE Microsoft Defender XDR rebranding]
Important
Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Each row in the DeviceTvmBrowserExtensions table contains information about browser extension installations found on devices from Microsoft Defender Vulnerability Management.
This advanced hunting table is populated by records from Microsoft Defender for Endpoint. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Endpoint in Defender XDR, read Deploy supported services.
For information on other tables in the advanced hunting schema, see the advanced hunting reference.
| Column name | Data type | Description |
|---|---|---|
DeviceId |
string |
Unique identifier for the device in the service |
BrowserName |
string |
Name of the web browser with the extension |
ExtensionId |
string |
Unique identifier for the browser extension |
ExtensionName |
string |
Name of the extension |
ExtensionDescription |
string |
Description from the publisher about the extension |
ExtensionVersion |
string |
Version number of the extension |
ExtensionRisk |
string |
Risk level for the extension based on the permissions it has requested |
ExtensionVendor |
string |
Name of the vendor offering the extension |
IsActivated |
string |
Whether the extension is turned on or off on the devices |
InstallationTime |
datetime |
Date and time when the browser extension was first installed |
- Proactively hunt for threats
- Learn the query language
- Use shared queries
- Hunt across devices, emails, apps, and identities
- Understand the schema
- Apply query best practices
- Overview of Microsoft Defender Vulnerability Management
[!INCLUDE Microsoft Defender XDR rebranding]