Configuring Web Browser Monitoring

Enable the Scanner module, deploy the browser extension, and verify that web applications are discovered.

Before you begin

The BigFix Scanner Service must be installed and running on the target endpoints, on Windows, with Google Chrome. For more information, refer to Web browser monitoring.

About this task

This topic covers the whole deployment, end to end. Work through the steps in order: an extension installed before the module is enabled cannot report to it.

Procedure

  1. Enable the web browser monitoring module and obtain the extension link.
    Web browser monitoring is disabled by default. Enabling the module and obtaining the Chrome Web Store link are both done from the same fixlet.
    1. In the BigFix console, open the BigFix Scanner site and open the Configure Scanner Service fixlet (fixlet 104).
    2. Set Browser Monitoring Admin Status to Enable.
      This option is marked (Windows only) in the fixlet: it has no effect on macOS endpoints.
    3. Note the Chrome Web Store link shown in the fixlet description, below the parameter table.
      The fixlet description links directly to the extension's Chrome Web Store listing; there is no separate fixlet or task for obtaining the link.
    4. If you plan to deploy the extension with a Chrome enterprise policy, also note the extension ID shown in the fixlet's parameter table.
      The ID is required for the ExtensionInstallForcelist policy. Do not record or publish it outside the fixlet; always retrieve it from the fixlet at deployment time, since it can change between releases.
    5. Select the target endpoints and run the action.
    The Scanner Service restarts to apply the change.
    Note: Configure Scanner Service restarts the Scanner Service. Plan for that on endpoints where a scan is in progress.

    To confirm the module started, check <BESClient dir>\tools\scanner\logs\bf-scanner.log on an endpoint for entries from the browsermon component.

  2. Install the extension in Chrome.
    The extension must be installed in each Chrome browser you want to monitor. For managed fleets, deploying it through Chrome enterprise policy (Option A) is recommended, consistent with how other managed browser extensions are typically deployed: it requires no action from the end user.
    Option A - deploy with a Chrome enterprise policy
    Add the extension ID noted from the Configure Scanner Service fixlet's parameter table to the ExtensionInstallForcelist policy, using whatever mechanism you already use for Chrome policy (Group Policy, the Google Admin console, or a registry-based configuration). This is standard Chrome enterprise-management behavior: the extension is deployed and kept up to date automatically for managed endpoints, and end users are not required to install it themselves or able to remove it, the same as any other extension deployed this way.
    Option B - users install it themselves
    Send them the Chrome Web Store link from the previous step. The user opens it, selects Add to Chrome, and confirms the permission prompt. The extension starts reporting immediately; no sign-in and no configuration are required.
    Note: The permission prompt asks for access to data on the websites the user visits. That access is what lets the extension report which applications are open; see Data collected for what is and is not reported. Tell users in advance what the prompt says, so they understand the request and do not decline it by mistake.
  3. Verify that data is collected.
    Verify from the endpoint outwards; each check isolates a different part of the chain.
    1. Module running
      bf-scanner.log shows browsermon entries for the module starting and the HTTP Server binding a port.
    2. Extension installed
      It appears and is enabled in chrome://extensions.
    3. Requests arriving
      Open a detectable web application, leave the tab open for at least one reporting interval, then check bf-scanner.log for a request being received and processed.
    4. Components recorded
      Inspect the browsermon_matched_components table in the Scanner Service database. See Using BigFix Scanner Service Data.
    5. SWID tags written
      Check <BESClient dir>\tools\scanner\data\browsermon\swidtags for files named <os_user_directory_name>_<swidtag-id>.swidtag. The job runs every 5 minutes, so allow for that delay.
    6. Reported in BigFix Inventory
      After the next scan upload and data import, the application appears with the install location <home_dir>\BigFix\Web Applications.
    Note: Allow one full cycle - reporting interval, then the 5-minute SWID job, then scan upload and data import - before concluding something is wrong. End to end, first results can take several hours.
    If a step fails, see Troubleshooting web browser monitoring.
  4. Turn web browser monitoring off, when no longer needed.
    Disable the module: open Configure Scanner Service, set Browser Monitoring Admin Status to Disable, and run the action. The Scanner Service restarts and stops accepting requests. The extension keeps trying to connect until removed; those attempts are local only and fail silently.
    Disabling the module does not remove previously collected data: the browsermon_* database tables and the SWID tag files are left in place. Discovered applications continue to be reported to BigFix Inventory from existing SWID tags until they age out after 30 days of inactivity, or until you remove them manually.
    Remove the extension:
    Installed by Removal
    Policy (force-install) Remove the extension ID from ExtensionInstallForcelist. Chrome removes it at the next policy refresh. The user cannot remove it.
    The user The user removes it from chrome://extensions, or you remove it with a Chrome enterprise policy.