Web browser monitoring

Requirements

How it works

Endpoint (Windows)
  Google Chrome
    Browser Extension
      | addresses of open tabs
      v
  BigFix Scanner Service
    - HTTP Server module (IngressHub)
    - Web browser monitoring module (browsermon)
        - matches addresses against known applications
        - stores matches in bf-scanner.db
        - writes SWID tag files
           |
           v
  Scan results, collected by the BigFix client
       |
       v
BigFix Inventory

1. At regular intervals, the extension sends the addresses of the pages currently open in the browser to the Scanner on the local computer.
2. The Scanner accepts the request only from the loopback address and only when the Host and Origin headers match approved values. Other requests are rejected with HTTP 403.
3. The Scanner determines which operating system user is running the browser by looking up the local TCP connection table for the loopback connection's source port, finding the process that owns it (the Chrome process), and resolving that process's operating system user and home directory. Attribution is per operating system user, not per browser profile, and not per application account. If the browser is running as a different user (for example through Run as), applications are attributed to that user.
4. Each address is compared against the patterns for known applications. Addresses matching nothing are not recorded as components.
5. A new match creates a record with first-seen and last-seen timestamps; a repeat match updates last-seen.
6. A background job runs every 5 minutes: it creates SWID tag files for new matches and removes tag files and database records for applications not seen for more than 30 days.
7. SWID tag files are collected like any other software identification tag. Discovered applications appear in BigFix Inventory with the install location <home_dir>/BigFix/Web Applications.

While the module is populating its database at start-up, and while the 5-minute maintenance job runs, the Scanner rejects requests with HTTP 503. The extension retries automatically, so no action is needed - but short gaps appear in the logs.

Detectable applications

The list of detectable web applications is defined by a configuration embedded in the Scanner. It cannot be edited in this release, and is not exposed through the Scanner CLI. Applications not in that configuration are not discovered. The set changes with the Scanner version; upgrading may make additional applications detectable, and when the configuration changes, SWID tag files are regenerated to match.

At release time, the embedded configuration detects the following web applications:

Data collected

What the extension sends. The addresses of the pages open in the browser, to the BigFix Scanner Service on the same computer. The extension does not send this data to HCL, to Google, or to any other external destination.

The extension does not collect:

• page content, including text typed into or displayed by a web application
• credentials, cookies, or authentication tokens
• form input, clipboard contents, downloads, or uploaded files
• browsing history from before the extension was installed

What the Scanner stores. Per operating system user: the matched application, the time it was first seen, and the time it was last seen. Individual page addresses are not stored as such. Based on review of the Scanner's matching code, addresses that do not match a known web application are compared in memory and discarded; they are not written to disk or transmitted off the endpoint.

What reaches the BigFix server. Only discovered software components and their SWID tags, collected as part of normal scan results: application name, publisher, tag identifier, operating system user name, and first-seen/last-seen timestamps.

User identification. Applications are attributed to the operating system user running the browser. The extension does not report the account signed in to the web application, and the Scanner does not attempt to determine it.

Limitations

• Microsoft Windows only.
• Google Chrome only. Edge, Firefox, and Safari are not supported.
• Requires the BigFix Scanner Service; not available with the Wscan-only component.
• The set of detectable applications is fixed and cannot be modified.
• Applications are attributed to the operating system user, not to the account signed in to the application.