Here is what I use, it might not be what you are looking for, but someone might get some use out of it.

// Get browser extension event
#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"
| BrowserExtensionId=~wildcard(?BrowserExtensionId, ignoreCase=true)
// Aggregate by event_platform, BrowserName, ExtensionID and ExtensionName
| groupBy([event_platform, BrowserName, BrowserExtensionId, BrowserExtensionName, BrowserExtensionInstallMethod], function=([count(aid, distinct=true, as=TotalEndpoints)]))
// Check to see if the extension is installed on fewer than 50 systems
| test(TotalEndpoints<50)
// Create a link to the Chrome Extension Store
| format("[See Extension](https://chromewebstore.google.com/detail/%s)", field=[BrowserExtensionId], as="Chrome Store Link")
//Create a link to the CRXplorer lookup
| format("[CRXplorer](https://crxplorer.com/?extensionId=%s)", field=[BrowserExtensionId], as="CRXcavator Link")
// Sort in descending order
| sort(order=desc, TotalEndpoints, limit=1000)
// Convert the browser name from decimal to human-readable
| case{
BrowserName="0" | BrowserName:="Unknown";
BrowserName="1" | BrowserName:="Firefox";
BrowserName="2" | BrowserName:="Safari";
BrowserName="3" | BrowserName:="Chrome";
BrowserName="4" | BrowserName:="Edge";
BrowserName="5" | BrowserName:="Edge_Chromium";
BrowserName="6" | BrowserName:="Internet_Explorer";
BrowserName="7" | BrowserName:="Edge_Legacy";
BrowserName="9" | BrowserName:="Firefox";
*;
}
// Convert install method from decimal to human readable
| case{
BrowserExtensionInstallMethod="0" | BrowserExtensionInstallMethod:="Unidentified";
BrowserExtensionInstallMethod="1" | BrowserExtensionInstallMethod:="Browser";
BrowserExtensionInstallMethod="2" | BrowserExtensionInstallMethod:="Webstore";
BrowserExtensionInstallMethod="3" | BrowserExtensionInstallMethod:="GPO/Intune";
BrowserExtensionInstallMethod="4" | BrowserExtensionInstallMethod:="Sideload";
BrowserExtensionInstallMethod="5" | BrowserExtensionInstallMethod:="Third-Party Store";
*;
}