How to List Microsoft Office Add-ins Across All Mac and Windows Devices

Introduction

Microsoft Office Add-ins are plugins that extend the functionality of Microsoft Office programs like Word, Excel, PowerPoint, OneNote, Project, and Outlook.

Office Add-ins are built on web technologies and can do almost anything a standard web-app running in a browser can do. In practice, Office Add-ins can add new UI elements (like menus or toolbars), create new embeddable objects, or extend functionality (ex: automatically convert UPS tracking numbers into hyperlinks)

You can learn more about Microsoft Office Add-ins by reading Microsoft's developer documentation

What Microsoft Office Add-in Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Microsoft Office Add-ins from Mac and Windows devices in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Microsoft Office Add-ins Schema

What Can You Do With This Information?

Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:

SELECT 
  device_name, 
  CASE WHEN LENGTH(hostnames) > 63 
       THEN CONCAT(SUBSTRING(hostnames,1,64),'...') 
       ELSE hostnames 
    END AS hostnames_truncated,
  address
 FROM device_etc_hosts 
 WHERE hostnames ILIKE '%adobe%'

Why Should I Collect Microsoft Office Add-ins?

Microsoft Office Add-ins depending on their permissions, may have the ability to read and alter the content of documents.

Microsoft Office Add-ins are cataloged and tracked to facilitate a number of potential purposes, for example:

• Reviewing installed add-ins to verify the desired configuration of Microsoft Office (eg. PhishMe's extension is installed in Outlook)
• Discovering potential malicious add-ins

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

Microsoft Office Add-ins which you install could reveal suggestive details about the tools you like to use to generate documents or to assist with answering email (if you use Microsoft Outlook).

Cataloging Microsoft Add-ins will not allow Kolide admins to view documents, emails, or other sensitive materials authored in those programs.

When you use Kolide to list Microsoft Office Add-in data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.