Surface IntelliJ plugins in software inventory

[ddribeiro]

• customer-ufa: Gong snippet
• customer-stazzema: Gong snippet
• @noahtalerman: User requested this because TODO
  • @noahtalerman: In the interim users can add a scheduled query (like the one here) to collect installed IntelliJ plugins. They can then use a vulnerbility feed (ex. NVD) to see which IntelliJ plugins are vulnerable and thus which hosts have vulnerable IntelliJ plugins.
  • @noahtalerman: Eventually Fleet could surface IntelliJ plugins and CVEs in Fleet's software inventory (Software page)

---

User stories

• 22463

[JoStableford]

Related to a Slack conversation

[noahtalerman]

@ddribeiro do you use IntelliJ? Or is this a customer request?

I do not believe there is an osquery table to do the same for IntelliJ plugins.

That's my gut feeling too. Although we could be wrong.

@nonpunctual do you know if there's an IntelliJ plugin osquery table? Maybe an open source one that we can bring into Fleet.

[ddribeiro]

@noahtalerman, This is for customer-stazzema (I forgot to add the label when I created this).

[nonpunctual]

Not that I know of @noahtalerman - we'd be making it I guess or creating an extension.

[noahtalerman]

Hey @ksatter, @pintomi1989 let me know that there's a query we could write to grab IntelliJ plugins.

Do you know what the query would look like? Is there a table that we can use or is Kathy imagining something else?

Mike also mentioned that the query's results would be cut off at 1k results. The cap is 1k results by default but in a recent release we added the ability to increase the cap: https://fleetdm.com/docs/configuration/yaml-files#server-settings

[ksatter]

@noahtalerman I have a query that can grab the plugins, but I haven't found a way to get the installed version. It looks like that's locked away inside of the .jar

SELECT 
  split(directory, '/', 5) AS product,  
  filename AS plugin, 
  datetime(ctime, 'unixepoch', 'localtime') AS installed_at,  
  datetime(mtime, 'unixepoch', 'localtime') AS last_modified 
FROM file 
WHERE directory LIKE '/Users/%/Library/Application Support/JetBrains/%/plugins/' AND type='directory';

[nonpunctual]

@noahtalerman I sent you DM with information on an extension related to this.

[noahtalerman]

@ksatter nice work on that query 🔥

@nonpunctual, are customer-ufa and customer-stazzema going to deploy the extension?

[nonpunctual]

@noahtalerman @ddribeiro @zayhanlon I don't know what the status is with either customer but customer-stazzema recent support case is what prompted the discovery on this issue.

[noahtalerman]

Hey @nonpunctual, @ddribeiro, and @zayhanlon we peeled a user story here off this request and pulled it into the current design sprint.

[noahtalerman]

Moved the original issue description here for safekeeping:

Problem

As a security engineer, I want to see IntelliJ plugins and related CVEs collected in Fleet’s software inventory.

What have you tried?

In the Fleet UI, I tried navigating to the Software tab and checking for IntelliJ plugins, but they are not collected by Fleet’s software inventory query so they do not appear.

Potential solutions

We recently did something similar in #15997 with VSCode extensions by using the vscode_extensions osquery table. I do not believe there is an osquery table to do the same for IntelliJ plugins.

What is the expected workflow as a result of your proposal?

As a result of this proposal, I would be able to use Fleet to identify which IntelliJ plugins are installed on my hosts and use vulnerability data to remediate vulnerabilities that I am concerned about.

[noahtalerman]

@zayhanlon @pintomi1989 can you please add Gong snippets for ufa and stazzema? Thanks!

[zayhanlon]

@noahtalerman done - all the context is actually on the customer-stazzema link. ufa is interested in this more from a vuln mangement and visibility standpoint

[nonpunctual]

@ksatter @ddribeiro was the extension found for this used by the customer & added to their config? Thanks.

[ksatter]

@ksatter @ddribeiro was the extension found for this used by the customer & added to their config? Thanks.

Which extension is that @nonpunctual?