diff --git a/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md b/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md
index b4ce740a..f26d209e 100644
--- a/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md
+++ b/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md
@@ -10,6 +10,7 @@ This script is designed to deploy the extension to both Chrome and Edge. It is r
1. Review the Extension Configuration Settings and Custom Branding Settings variables and update those to your desired values. The current values in the script are the default values. Leaving any unchanged will set the defaults.
2. If you are leveraging a RMM that has the ability to define the variables in the deployment section of scripting, then you may be able to remove this section and enter the variable definitions into the RMM scripting pages.
+3. For webhook deployment, configure `$enableGenericWebhook`, `$webhookUrl`, and `$webhookEvents` in the script. Supported events are documented in [Webhook Documentation](../../../webhooks.md).
Download the Script from GitHub
{% endtab %}
diff --git a/enterprise/Check-Extension-Policy.reg b/enterprise/Check-Extension-Policy.reg
index fce2f70c..afef703a 100644
--- a/enterprise/Check-Extension-Policy.reg
+++ b/enterprise/Check-Extension-Policy.reg
@@ -13,16 +13,25 @@ Windows Registry Editor Version 5.00
"showNotifications"=dword:00000001
"enableValidPageBadge"=dword:00000000
"enablePageBlocking"=dword:00000001
-"enableCippReporting"=dword:00000001
-"cippServerUrl"=""
-"cippTenantId"=""
-"customRulesUrl"=""
-"updateInterval"=dword:00000018
-"enableDebugLogging"=dword:00000000
-
-; Custom branding configuration
-[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\customBranding]
-"companyName"="CyberDrain"
+"enableCippReporting"=dword:00000001
+"cippServerUrl"=""
+"cippTenantId"=""
+"customRulesUrl"=""
+"updateInterval"=dword:00000018
+"enableDebugLogging"=dword:00000000
+
+; Generic webhook configuration (optional)
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\genericWebhook]
+"enabled"=dword:00000000
+"url"=""
+
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\genericWebhook\events]
+"1"="detection_alert"
+"2"="page_blocked"
+
+; Custom branding configuration
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\customBranding]
+"companyName"="CyberDrain"
"productName"="Check"
"supportEmail"=""
"primaryColor"="#F77F00"
@@ -45,16 +54,25 @@ Windows Registry Editor Version 5.00
"showNotifications"=dword:00000001
"enableValidPageBadge"=dword:00000000
"enablePageBlocking"=dword:00000001
-"enableCippReporting"=dword:00000001
-"cippServerUrl"=""
-"cippTenantId"=""
-"customRulesUrl"=""
-"updateInterval"=dword:00000018
-"enableDebugLogging"=dword:00000000
-
-; Custom branding configuration for Chrome
-[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\customBranding]
-"companyName"="CyberDrain"
+"enableCippReporting"=dword:00000001
+"cippServerUrl"=""
+"cippTenantId"=""
+"customRulesUrl"=""
+"updateInterval"=dword:00000018
+"enableDebugLogging"=dword:00000000
+
+; Generic webhook configuration for Chrome (optional)
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\genericWebhook]
+"enabled"=dword:00000000
+"url"=""
+
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\genericWebhook\events]
+"1"="detection_alert"
+"2"="page_blocked"
+
+; Custom branding configuration for Chrome
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\customBranding]
+"companyName"="CyberDrain"
"productName"="Check"
"supportEmail"=""
"primaryColor"="#F77F00"
diff --git a/enterprise/README.md b/enterprise/README.md
index 5ec8974e..db3e4f18 100644
--- a/enterprise/README.md
+++ b/enterprise/README.md
@@ -26,8 +26,9 @@ This folder contains enterprise deployment resources for the Check Microsoft 365
## Quick Links
- **Chrome/Edge Deployment**: See `Deploy-Windows-Chrome-and-Edge.ps1` for Windows, `macos-linux/` for macOS/Linux
-- **Firefox Deployment**: See `firefox/policies.json` template and [Firefox Deployment Guide](../docs/deployment/firefox-deployment.md)
-- **Configuration Schema**: See `../config/managed_schema.json` for all available settings
+- **Firefox Deployment**: See `firefox/policies.json` template and [Firefox Deployment Guide](../docs/deployment/firefox-deployment.md)
+- **Configuration Schema**: See `../config/managed_schema.json` for all available settings
+- **Webhook Configuration**: See `../docs/webhooks.md` for webhook payloads and supported event types
## Security Considerations
diff --git a/enterprise/Remove-Windows-Chrome-and-Edge.ps1 b/enterprise/Remove-Windows-Chrome-and-Edge.ps1
index fed3c9d9..9e33788b 100644
--- a/enterprise/Remove-Windows-Chrome-and-Edge.ps1
+++ b/enterprise/Remove-Windows-Chrome-and-Edge.ps1
@@ -58,6 +58,41 @@ function Remove-ExtensionSettings {
}
}
+ # Remove generic webhook subkey and event properties
+ $genericWebhookKey = "$ManagedStorageKey\genericWebhook"
+ if (Test-Path $genericWebhookKey) {
+ $webhookEventsKey = "$genericWebhookKey\events"
+ if (Test-Path $webhookEventsKey) {
+ $eventProperties = Get-ItemProperty -Path $webhookEventsKey -ErrorAction SilentlyContinue
+ if ($eventProperties) {
+ $eventProperties.PSObject.Properties | Where-Object { $_.Name -match '^\d+$' } | ForEach-Object {
+ Remove-ItemProperty -Path $webhookEventsKey -Name $_.Name -Force -ErrorAction SilentlyContinue
+ Write-Host "Removed webhook event property: $($_.Name) from $webhookEventsKey"
+ }
+ }
+ try {
+ Remove-Item -Path $webhookEventsKey -Force -ErrorAction SilentlyContinue
+ Write-Host "Removed webhook events subkey: $webhookEventsKey"
+ } catch {
+ # Key may not be empty or may have been removed already
+ }
+ }
+
+ foreach ($property in @("enabled", "url")) {
+ if (Get-ItemProperty -Path $genericWebhookKey -Name $property -ErrorAction SilentlyContinue) {
+ Remove-ItemProperty -Path $genericWebhookKey -Name $property -Force -ErrorAction SilentlyContinue
+ Write-Host "Removed generic webhook property: $property from $genericWebhookKey"
+ }
+ }
+
+ try {
+ Remove-Item -Path $genericWebhookKey -Force -ErrorAction SilentlyContinue
+ Write-Host "Removed generic webhook subkey: $genericWebhookKey"
+ } catch {
+ # Key may not be empty or may have been removed already
+ }
+ }
+
# Remove custom branding subkey and all its properties
$customBrandingKey = "$ManagedStorageKey\customBranding"
if (Test-Path $customBrandingKey) {
diff --git a/enterprise/Test-Extension-Policy.ps1 b/enterprise/Test-Extension-Policy.ps1
index 6a07d23e..9fae3241 100644
--- a/enterprise/Test-Extension-Policy.ps1
+++ b/enterprise/Test-Extension-Policy.ps1
@@ -33,6 +33,12 @@ $testBranding = @{
logoUrl = ""
}
+$testGenericWebhook = @{
+ enabled = 0
+ url = ""
+ events = @("detection_alert", "page_blocked")
+}
+
function Set-TestPolicies {
param([string]$PolicyKey)
@@ -55,6 +61,22 @@ function Set-TestPolicies {
foreach ($key in $testBranding.Keys) {
New-ItemProperty -Path $brandingKey -Name $key -PropertyType String -Value $testBranding[$key] -Force | Out-Null
}
+
+ $genericWebhookKey = "$PolicyKey\genericWebhook"
+ if (!(Test-Path $genericWebhookKey)) {
+ New-Item -Path $genericWebhookKey -Force | Out-Null
+ }
+ New-ItemProperty -Path $genericWebhookKey -Name "enabled" -PropertyType DWord -Value $testGenericWebhook.enabled -Force | Out-Null
+ New-ItemProperty -Path $genericWebhookKey -Name "url" -PropertyType String -Value $testGenericWebhook.url -Force | Out-Null
+
+ $webhookEventsKey = "$genericWebhookKey\events"
+ if (!(Test-Path $webhookEventsKey)) {
+ New-Item -Path $webhookEventsKey -Force | Out-Null
+ }
+ Remove-ItemProperty -Path $webhookEventsKey -Name * -Force -ErrorAction SilentlyContinue | Out-Null
+ for ($i = 0; $i -lt $testGenericWebhook.events.Count; $i++) {
+ New-ItemProperty -Path $webhookEventsKey -Name ($i + 1) -PropertyType String -Value $testGenericWebhook.events[$i] -Force | Out-Null
+ }
Write-Output "Applied test policies to: $PolicyKey"
}
@@ -71,6 +93,12 @@ function Show-CurrentPolicies {
Write-Output "`nCustom Branding:"
Get-ItemProperty -Path $brandingKey | Format-List
}
+
+ $genericWebhookKey = "$PolicyKey\genericWebhook"
+ if (Test-Path $genericWebhookKey) {
+ Write-Output "`nGeneric Webhook:"
+ Get-ItemProperty -Path $genericWebhookKey | Format-List
+ }
} else {
Write-Output "No policies set at: $PolicyKey"
}
diff --git a/enterprise/admx/Check-Extension.admx b/enterprise/admx/Check-Extension.admx
index d69c2620..55eaef08 100644
--- a/enterprise/admx/Check-Extension.admx
+++ b/enterprise/admx/Check-Extension.admx
@@ -113,14 +113,44 @@
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -297,14 +327,44 @@
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/enterprise/admx/en-US/Check-Extension.adml b/enterprise/admx/en-US/Check-Extension.adml
index 078a8c12..1b0e4854 100644
--- a/enterprise/admx/en-US/Check-Extension.adml
+++ b/enterprise/admx/en-US/Check-Extension.adml
@@ -108,17 +108,47 @@
CIPP tenant identifier
-
- This policy specifies the tenant identifier to include with CIPP alerts for multi-tenant environments.
-
- Example: contoso.onmicrosoft.com
-
- This helps identify which tenant/organization the security event originated from when using a shared CIPP instance.
-
-
- Custom detection rules URL
-
- This policy specifies a custom URL from which the extension should fetch detection rules.
+
+ This policy specifies the tenant identifier to include with CIPP alerts for multi-tenant environments.
+
+ Example: contoso.onmicrosoft.com
+
+ This helps identify which tenant/organization the security event originated from when using a shared CIPP instance.
+
+
+ Enable generic webhook
+
+ This policy controls whether the Check extension sends selected security events to a custom webhook endpoint.
+
+ When enabled: Events listed in "Generic webhook event types" are sent to the configured Generic Webhook URL.
+ When disabled (default): No generic webhook events are sent.
+
+ Note: Requires Generic Webhook URL and at least one event type.
+
+ Generic webhook URL
+
+ This policy specifies the URL for a custom webhook endpoint that receives Check event payloads.
+
+ Example: https://webhook.yourcompany.com/check-events
+
+ This setting is only used when generic webhook is enabled.
+
+ Generic webhook event types
+
+ This policy specifies which event types are sent to the generic webhook endpoint.
+
+ Supported values:
+ - detection_alert
+ - false_positive_report
+ - page_blocked
+ - rogue_app_detected
+ - threat_detected
+ - validation_event
+
+
+ Custom detection rules URL
+
+ This policy specifies a custom URL from which the extension should fetch detection rules.
Example: https://yourcompany.com/detection-rules.json
@@ -293,17 +323,47 @@
CIPP tenant identifier (Chrome)
-
- This policy specifies the tenant identifier to include with CIPP alerts for multi-tenant environments from Google Chrome.
-
- Example: contoso.onmicrosoft.com
-
- This helps identify which tenant/organization the security event originated from when using a shared CIPP instance.
-
-
- Custom detection rules URL (Chrome)
-
- This policy specifies a custom URL from which the extension should fetch detection rules in Google Chrome.
+
+ This policy specifies the tenant identifier to include with CIPP alerts for multi-tenant environments from Google Chrome.
+
+ Example: contoso.onmicrosoft.com
+
+ This helps identify which tenant/organization the security event originated from when using a shared CIPP instance.
+
+
+ Enable generic webhook (Chrome)
+
+ This policy controls whether the Check extension sends selected security events to a custom webhook endpoint in Google Chrome.
+
+ When enabled: Events listed in "Generic webhook event types (Chrome)" are sent to the configured Generic Webhook URL.
+ When disabled (default): No generic webhook events are sent.
+
+ Note: Requires Generic Webhook URL and at least one event type.
+
+ Generic webhook URL (Chrome)
+
+ This policy specifies the URL for a custom webhook endpoint that receives Check event payloads from Google Chrome.
+
+ Example: https://webhook.yourcompany.com/check-events
+
+ This setting is only used when generic webhook is enabled.
+
+ Generic webhook event types (Chrome)
+
+ This policy specifies which event types are sent to the generic webhook endpoint from Google Chrome.
+
+ Supported values:
+ - detection_alert
+ - false_positive_report
+ - page_blocked
+ - rogue_app_detected
+ - threat_detected
+ - validation_event
+
+
+ Custom detection rules URL (Chrome)
+
+ This policy specifies a custom URL from which the extension should fetch detection rules in Google Chrome.
Example: https://yourcompany.com/detection-rules.json
@@ -382,16 +442,24 @@
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+ Generic Webhook Event Types:
+
+
+
+
+
+
Update Interval (hours):
@@ -439,16 +507,24 @@
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+ Generic Webhook Event Types:
+
+
+
+
+
+
Update Interval (hours):
@@ -491,4 +567,4 @@
-
\ No newline at end of file
+
diff --git a/enterprise/macos-linux/README.md b/enterprise/macos-linux/README.md
index 8e1d55a2..835a75f5 100644
--- a/enterprise/macos-linux/README.md
+++ b/enterprise/macos-linux/README.md
@@ -154,13 +154,18 @@ All settings are based on the managed schema and include:
- **`enableCippReporting`** - Enable CIPP server reporting (default: false)
- **`enableDebugLogging`** - Enable debug logging (default: false)
-### CIPP Integration
-- **`cippServerUrl`** - CIPP server URL for reporting
-- **`cippTenantId`** - Tenant identifier for multi-tenant environments
-
-### Rule Management
-- **`customRulesUrl`** - URL for custom detection rules
-- **`updateInterval`** - Rule update interval in hours (default: 24)
+### CIPP Integration
+- **`cippServerUrl`** - CIPP server URL for reporting
+- **`cippTenantId`** - Tenant identifier for multi-tenant environments
+
+### Generic Webhook Integration
+- **`genericWebhook.enabled`** - Enable sending events to custom webhook endpoint
+- **`genericWebhook.url`** - Webhook endpoint URL
+- **`genericWebhook.events`** - Event types to send (`detection_alert`, `false_positive_report`, `page_blocked`, `rogue_app_detected`, `threat_detected`, `validation_event`)
+
+### Rule Management
+- **`customRulesUrl`** - URL for custom detection rules
+- **`updateInterval`** - Rule update interval in hours (default: 24)
### Custom Branding
- **`companyName`** - Company name for white labeling
@@ -258,12 +263,13 @@ ls -la /etc/microsoft-edge/policies/managed/
## Customization
-Before deployment, edit the JSON files to customize:
-1. **CIPP Integration** - Set `cippServerUrl` and `cippTenantId`
-2. **Custom Rules** - Set `customRulesUrl` to your rules endpoint
-3. **Branding** - Configure company name, colors, and logo URL
-4. **Security Settings** - Adjust notification and blocking preferences
-5. **Debug Mode** - Enable `enableDebugLogging` for troubleshooting
+Before deployment, edit the JSON files to customize:
+1. **CIPP Integration** - Set `cippServerUrl` and `cippTenantId`
+2. **Webhook Integration** - Configure `genericWebhook.enabled`, `genericWebhook.url`, and `genericWebhook.events`
+3. **Custom Rules** - Set `customRulesUrl` to your rules endpoint
+4. **Branding** - Configure company name, colors, and logo URL
+5. **Security Settings** - Adjust notification and blocking preferences
+6. **Debug Mode** - Enable `enableDebugLogging` for troubleshooting
## Security Considerations
diff --git a/enterprise/macos-linux/check-extension-config.mobileconfig b/enterprise/macos-linux/check-extension-config.mobileconfig
index c3b77bb6..37c479d9 100644
--- a/enterprise/macos-linux/check-extension-config.mobileconfig
+++ b/enterprise/macos-linux/check-extension-config.mobileconfig
@@ -41,16 +41,28 @@
Value
- cippTenantId
-
- Value
-
-
- customRulesUrl
-
- Value
- https://raw.githubusercontent.com/CyberDrain/Check/refs/heads/main/rules/detection-rules.json
-
+ cippTenantId
+
+ Value
+
+
+ genericWebhook
+
+ Value
+
+ enabled
+
+ url
+
+ events
+
+
+
+ customRulesUrl
+
+ Value
+ https://raw.githubusercontent.com/CyberDrain/Check/refs/heads/main/rules/detection-rules.json
+
updateInterval
Value
@@ -102,4 +114,4 @@
TargetDeviceType
5
-
\ No newline at end of file
+
diff --git a/enterprise/macos-linux/deploy-extension-prefs.sh b/enterprise/macos-linux/deploy-extension-prefs.sh
index 65b2b451..2f76344a 100644
--- a/enterprise/macos-linux/deploy-extension-prefs.sh
+++ b/enterprise/macos-linux/deploy-extension-prefs.sh
@@ -71,6 +71,15 @@ create_extension_preferences() {
cippTenantId
+ genericWebhook
+
+ enabled
+
+ url
+
+ events
+
+
customRulesUrl
$custom_rules_url
updateInterval
@@ -211,4 +220,4 @@ main() {
esac
}
-main "$@"
\ No newline at end of file
+main "$@"