[pull] dev from CyberDrain:dev

docs/README.md

@@ -26,33 +26,33 @@ Specifically designed for enterprises and managed service providers, Check uses
 
 Check is available for **Chrome**, **Microsoft Edge**, and **Firefox** (109+ <mark style="color:orange;">Coming Soon!</mark>).
 
-The extension integrates seamlessly with existing security workflows, offering centralized management, comprehensive logging, and offers an optional CIPP integration for MSPs managing multiple Microsoft 365 tenants.
+The extension integrates seamlessly with existing security workflows, offering centralized management, comprehensive logging, and optional CIPP integration for MSPs managing multiple Microsoft 365 tenants.
 
-Check is completely free, open source, and can be delivered to users completely white-label, it is an open-source project licensed under AGPL-3. You can contribute to check at [https://github.com/cyberdrain/Check](https://github.com/cyberdrain/Check).
+Check is completely free and open source, can be delivered to users fully white-labeled, and is licensed under AGPL-3. You can contribute to Check at [https://github.com/cyberdrain/Check](https://github.com/cyberdrain/Check).
 
-Installing the plugin immediately gives you protection against AITM attacks and takes seconds. Click the install button and you're good to go.
+Installing the extension immediately gives you protection against AITM attacks and takes seconds. Click the install button and you're good to go.
 
 <a href="https://microsoftedge.microsoft.com/addons/detail/check-by-cyberdrain/knepjpocdagponkonnbggpcnhnaikajg" class="button primary">Install for Edge</a> **OR** <a href="https://chromewebstore.google.com/detail/benimdeioplgkhanklclahllklceahbe" class="button primary">Install for Chrome</a> **OR** <a href="./" class="button secondary">Firefox (Coming Soon!)</a>
 
 ## Why was Check created?
 
-Check was created out of a need to have better protection against AITM attacks. During a CyberDrain brainstorming session CyberDrain's lead dev came up with the idea to create a Chrome extension to protect users:
+Check was created out of a need for better protection against AITM attacks. During a CyberDrain brainstorming session, CyberDrain's lead developer came up with the idea to create a Chrome extension to protect users:
 
 <figure><img src=".gitbook/assets/image.png" alt=""><figcaption></figcaption></figure>
 
-This led to a hackathon in which the team crafted a proof of concept. This proof of concept led to the creation of Check by CyberDrain. CyberDrain decided to offer Check as a free to use community resource, for everyone.
+This led to a hackathon in which the team crafted a proof of concept. This proof of concept led to the creation of Check by CyberDrain. CyberDrain decided to offer Check as a free-to-use community resource for everyone.
 
 ### What information does Check collect?
 
-Nothing. We're not even kidding, we don't collect any data at all. You can set up a CIPP reporting server if you'd like, but this reports directly to your own environment. CyberDrain doesn't believe in making their users a product. We don't sell or collect any information.
+Nothing. We're not even kidding: we don't collect any data at all. You can set up a CIPP reporting server if you'd like, but it reports directly to your own environment. CyberDrain doesn't believe in making its users a product. We don't sell or collect any information.
 
 ## How does it look?
 
-When a user gets the plugin added, a new icon will appear, this icon is [brandable](settings/branding.md) to customize it to your own logo and name.
+When the extension is added for a user, a new icon will appear. This icon is [brandable](settings/branding.md), allowing you to customize it with your own logo and name.
 
 <figure><img src=".gitbook/assets/image (1).png" alt=""><figcaption></figcaption></figure>
 
-When visiting a page that is suspect, but our certainty if the page is phishing is too low we'll show a banner on the page to warn users, if we're sure about the page being an AITM or phishing attack, we'll block the page entirely:
+When you visit a suspicious page but our certainty that it is phishing is too low, we'll show a banner to warn you. If we're sure that the page is an AITM or phishing attack, we'll block it entirely:
 
 <figure><img src=".gitbook/assets/image (3).png" alt=""><figcaption></figcaption></figure>
 

docs/SUMMARY.md

@@ -14,7 +14,7 @@
     - [Manual Deployment](deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md)
     - [Domain Deployment](deployment/chrome-edge-deployment-instructions/windows/domain-deployment.md)
     - [RMM Deployment](deployment/chrome-edge-deployment-instructions/windows/rmm-deployment.md)
-  - [MacOS](deployment/chrome-edge-deployment-instructions/macos.md)
+  - [macOS](deployment/chrome-edge-deployment-instructions/macos.md)
 - [Firefox Deployment](deployment/firefox-deployment.md)
 
 ## Removal

docs/advanced/creating-detection-rules.md

@@ -7,17 +7,17 @@ The extension uses a rule-driven architecture where all detection logic is defin
 * **Phishing indicators** - Patterns that detect malicious content (supports both regex and code-driven logic)
 * **Detection requirements** - Elements that identify Microsoft 365 login pages
 * **Blocking rules** - Conditions that immediately block pages
-* **Rogue apps detection** - Dynamic detection of known malicious OAuth applications
+* **Rogue app detection** - Dynamic detection of known malicious OAuth applications
 
-Each of these rules has their own schema. You can create a custom rules file and host it anywhere publicly (e.g. your own fork of Check's GitHub repo, as an Azure Blob file, etc.). By default, Check loads the CyberDrain rule set from our repository every 24 hours (configurable). Custom rules URLs must be CORS-accessible and return valid JSON matching the schema.
+Each rule type has its own schema. You can create a custom rules file and host it anywhere publicly, such as in your own fork of Check's GitHub repository or an Azure Blob. By default, Check loads the CyberDrain rule set from our repository every 24 hours (configurable). Custom rules URLs must be CORS-accessible and return valid JSON matching the schema.
 
 **Important:** After updating rules via the UI or changing custom URLs, reload any open tabs for changes to take effect on those pages. The extension loads rules at startup and on the configured interval.
 
-Contributions to our rules can be done via [https://github.com/CyberDrain/Check/blob/main/rules/detection-rules.json](https://github.com/CyberDrain/Check/blob/main/rules/detection-rules.json)
+You can contribute to our rules through [https://github.com/CyberDrain/Check/blob/main/rules/detection-rules.json](https://github.com/CyberDrain/Check/blob/main/rules/detection-rules.json).
 
 ## Rule Configuration and Updates
 
-Rules are managed by the [`DetectionRulesManager`](https://github.com/CyberDrain/Check/blob/main/scripts/modules/detection-rules-manager.js) class. It's job is to:
+Rules are managed by the [`DetectionRulesManager`](https://github.com/CyberDrain/Check/blob/main/scripts/modules/detection-rules-manager.js) class. Its job is to:
 
 * Load rules at extension startup
 * Check for updates based on the configured interval (default: 24 hours)
@@ -26,10 +26,10 @@ Rules are managed by the [`DetectionRulesManager`](https://github.com/CyberDrain
 
 **Update Process:**
 
-1. Rules are fetched from the configured URL (remote or fallback to local)
+1. Rules are fetched from the configured remote URL, with a fallback to the local file
 2. New rules are cached locally and immediately applied
 3. A message is sent to notify other extension components of the update
-4. Open tabs require reload to apply the new rules
+4. Open tabs require a reload to apply the new rules
 
 ## Exclusions
 
@@ -61,7 +61,7 @@ Use regex patterns that match the full URL:
 
 ### Trusted Domains
 
-These domains get immediate trusted status with valid badges:
+These domains receive immediate trusted status with valid badges:
 
 ```json
 "trusted_login_patterns": [
@@ -339,12 +339,12 @@ This rule triggers when:
 - Word proximity matters
 - You want to exclude certain contexts (allowlist patterns)
 - Performance is important (substring checks are faster than complex regex)
-- Rules are easier to maintain and understand
+- You want rules that are easier to maintain and understand
 
 **Use Regex When:**
 - You have a simple, single pattern to match
 - You need complex character matching
-- The pattern is already well-tested as regex
+- The pattern is already well-tested as a regex
 
 ### Pattern Properties
 
@@ -416,7 +416,7 @@ Configure what elements identify a legitimate Microsoft 365 login page:
 Check includes dynamic detection of known rogue OAuth applications that attempt to steal Microsoft 365 credentials. This feature:
 
 * Automatically fetches the latest list of rogue apps from the [Huntress Labs repository](https://github.com/huntresslabs/rogueapps)
-* Updates every 12 hours by default (configurable in `rogue_apps_detection` section)
+* Updates every 12 hours by default (configurable in the `rogue_apps_detection` section)
 * Warns users when they encounter known malicious OAuth applications
 * Caches data locally for offline protection
 

docs/deployment/chrome-edge-deployment-instructions/macos.md

@@ -2,12 +2,13 @@
 icon: apple
 ---
 
-# MacOS
-I'd recommend that this be deployed via your MDM if the goal is to auto-deploy it without user interaction. 
+# macOS
 
-A custom .mobileconfig file can be uploaded to most MDMs for deployment if they don't have their own Google Chrome, or Microsoft Edge profile building functionality baked-in.
+We recommend deploying Check through your MDM if the goal is to install it automatically without user interaction.
 
-Here's an example profile of the XML to create a mobileconfig that will install this in Microsoft Edge and Google Chrome. 
+A custom `.mobileconfig` file can be uploaded to most MDMs if they don't have built-in profile-building functionality for Google Chrome or Microsoft Edge.
+
+Here's an example XML profile for a mobile configuration that installs Check in Microsoft Edge and Google Chrome.
 
 ```
 <?xml version="1.0" encoding="UTF-8"?>
@@ -72,13 +73,13 @@ Here's an example profile of the XML to create a mobileconfig that will install
 </dict>
 </plist>
 ```
-You could also deploy it in Chrome via command-line by creating the proper JSON object in the correct directory in the core /Library directory in macOS. Credit to @cezaraugusto for the script (slightly modified to simply install 'Check' if no parameter is passed...though technically you could pass any other Chrome extension ID after the script path and it would install that extension). 
+You could also deploy it in Chrome from the command line by creating the appropriate JSON object in the correct location under the core `/Library` directory in macOS. Credit goes to @cezaraugusto for the script, which was slightly modified to install Check when no parameter is passed. You can also pass another Chrome extension ID after the script path to install that extension.
 
 ```
 #!/bin/bash
 
 # https://developer.chrome.com/docs/extensions/mv3/external_extensions/#preferences
-# Credit to #cezaraugusto# from GithubGist for this script...slightly modified for the purposes of installing Check by Cyberdrain if no parameter is passed
+# Credit to #cezaraugusto# from GitHub Gist for this script, slightly modified to install Check by CyberDrain if no parameter is passed
 # https://gist.github.com/cezaraugusto
 # https://gist.github.com/cezaraugusto/0101d2cb251c088f398ca0f8d4495ca0
 
@@ -111,19 +112,15 @@ fi
 
 install_chrome_extension "$extension"
 
-# Usage: 
+# Usage:
 # ./install_extension.sh <extension_id>
-# Sample: adding React Dev Tools from command-line to Chrome 
+# Sample: adding React Dev Tools from the command line to Chrome
 # ./install_extension.sh fmkadmapgofadopljbjfkapdkoienihi
 ```
 
-This would not install the extension until the next time Chrome is launched, and then it will require the user to approve it. 
+This does not install the extension until the next time Chrome is launched. The user will then be required to approve it.
 
 <img width="448" height="330" alt="SCR-20260520-krbi" src="https://github.com/user-attachments/assets/f53a13fe-c16b-4941-aa39-0799b2b32b6e" />
+Due to limitations like this, it is better to deploy the extension through an MDM.
 
-
-
-Due to limitations like this it really would be better to push it via an MDM. 
-
-
-If you have experience deploying managed MacOS browser extensions, please contribute to the [docs via GitHub](https://github.com/CyberDrain/Check/tree/dev/docs). All Mac resources in the GitHub repo should be considered inaccurate until tested.&#x20;
+If you have experience deploying managed macOS browser extensions, please contribute to the [docs via GitHub](https://github.com/CyberDrain/Check/tree/dev/docs). All macOS resources in the GitHub repo should be considered inaccurate until tested.

docs/deployment/chrome-edge-deployment-instructions/windows/README.md

@@ -7,7 +7,7 @@ icon: windows
 
 # Windows
 
-There are a few different options on how you can deploy Check to Windows devices. For more information on each, please see the page:
+There are several ways to deploy Check to Windows devices. For more information about each method, see the following pages:
 
 {% content-ref url="manual-deployment.md" %}
 [manual-deployment.md](manual-deployment.md)

docs/deployment/chrome-edge-deployment-instructions/windows/domain-deployment.md

@@ -2,7 +2,7 @@
 
 {% tabs %}
 {% tab title="Intune" %}
-The simplest method of Intune deployment is via a win32 script. Follow the steps below to deploy Check with Intune.
+The simplest method of Intune deployment is through a Win32 script. Follow the steps below to deploy Check with Intune.
 
 ***
 
@@ -16,7 +16,7 @@ The simplest method of Intune deployment is via a win32 script. Follow the steps
    1. Deploy-Windows-Chrome-and-Edge.ps1
    2. Remove-Windows-Chrome-and-Edge.ps1
    3. Detect-Windows-Chrome-and-Edge.ps1
-3. You will be prompted during the Setup script on how you want to configure Check. Follow the script's guidance to ensure you're accurately entering values for the script. These values will be used for both the Deploy and Detect to ensure the extension is properly deployed.
+3. The setup script will prompt you to configure Check. Follow its guidance to ensure that you enter each value accurately. These values will be used by both the deployment and detection scripts to verify that the extension is properly deployed.
 4. Set the output location the script will use to generate the three new scripts.
 
 {% hint style="info" %}
@@ -97,7 +97,7 @@ Keep **Run script as 32-bit process on 64-bit clients** set to **No** so the det
 
 ### Updating Settings
 
-When you need to change extension settings (e.g., enable page blocking, update branding):
+When you need to change extension settings (e.g., enable page blocking or update branding):
 
 1. Re-run the setup script with new values, or manually edit the config blocks in both `Deploy-` and `Detect-` scripts
 2. Re-package with `IntuneWinAppUtil.exe`
@@ -120,20 +120,19 @@ To remove the extension from managed devices:
 {% endtab %}
 
 {% tab title="Group Policy" %}
-1. Download the following from the Check repo on GitHub
+1. Download the following files from the Check repository on GitHub:
    1. ​[Deploy-ADMX.ps1](https://github.com/CyberDrain/Check/blob/main/enterprise/Deploy-ADMX.ps1)
    2. ​[Check-Extension.admx](https://github.com/CyberDrain/Check/blob/main/enterprise/admx/Check-Extension.admx)​
    3. ​[Check-Extension.adml](https://github.com/CyberDrain/Check/blob/main/enterprise/admx/en-US/Check-Extension.adml)​
-2. Run Deploy-ADMX.ps1. As long as you keep the other two files in the same folder, it will correctly add the available objects to Group Policy.
-3. Open Group Policy and create a policy using the imported settings that can be found at `Computer Configuration → Policies → Administrative Templates → CyberDrain → Check - Microsoft 365 Phishing Protection`
+2. Run `Deploy-ADMX.ps1`. As long as you keep the other two files in the same folder, it will correctly add the available objects to Group Policy.
+3. Open Group Policy and create a policy using the imported settings at `Computer Configuration → Policies → Administrative Templates → CyberDrain → Check - Microsoft 365 Phishing Protection`.
 
 ![](<../../../.gitbook/assets/image (2).png>)
 {% endtab %}
 
 {% tab title="CIPP Standard" %}
-You can use a CIPP standard to deploy Check. It works the same way that the [#intune](domain-deployment.md#intune "mention") instructions do but CIPP handles all the work for install and detection script building.
+You can use a CIPP standard to deploy Check. It works the same way as the [#intune](domain-deployment.md#intune "mention") instructions, but CIPP handles the installation and detection-script creation.
 
 For more, see our [Standards documentation](https://standards.cipp.app/standards/deploycheckchromeextension).
 {% endtab %}
 {% endtabs %}
-

docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md

@@ -5,18 +5,18 @@
 **Modify the following script and copy it to your RMM's scripting engine or run the script directly on the endpoint to deploy Check:**
 
 {% hint style="info" %}
-This script is designed to deploy the extension to both Chrome and Edge. It is recommended to deploy both even if you standardize on one. This will provide you with better protection in the case someone uses the non-favored browser.
+This script is designed to deploy the extension to both Chrome and Edge. We recommend deploying it to both browsers, even if you standardize on one. This provides better protection in case someone uses the non-preferred browser.
 {% endhint %}
 
 1. Review the Extension Configuration Settings and Custom Branding Settings variables and update those to your desired values. The current values in the script are the default values. Leaving any unchanged will set the defaults.
-2. If you are leveraging a RMM that has the ability to define the variables in the deployment section of scripting, then you may be able to remove this section and enter the variable definitions into the RMM scripting pages.
+2. If you are using an RMM that can define variables in its scripting interface, you may be able to remove this section and enter the variable definitions in the RMM instead.
 3. For webhook deployment, configure `$enableGenericWebhook`, `$webhookUrl`, and `$webhookEvents` in the script. Supported events are documented in [Webhook Documentation](../../../webhooks.md).
 
 <a href="https://github.com/ghraw/CyberDrain/Check/refs/heads/main/enterprise/Deploy-Windows-Chrome-and-Edge.ps1" class="button primary">Download the Script from GitHub</a>
 {% endtab %}
 
-{% tab title="Side Load" %}
-Developers who wish to test their code changes can side load the extension into their browser.&#x20;
+{% tab title="Sideload" %}
+Developers who wish to test their code changes can sideload the extension in their browser.
 
 1. Fork the repository and clone your fork
 2. Open `chrome://extensions` or `edge://extensions`