Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

All Metric entries

Showing 959 of 959

Windows Server: Unknown ScreenConnect Fingerprints

Replace the "xxxxxxxxxxxxxxxx" with your known ScreenConnect fingerprints. You can add additional fingerprints as needed with more "contains" statements separated by "||". These fingerprints can be found via software inventory (Add/Remove Programs...
Noah Tatum about 1 year ago in Windows Server 2

Microsoft 365: New users created 7 days ago with MFA disabled

This metric will allow you to find M365 users created 7 days ago and MFA is Disabled. We are using this metric along with an actionable alert to create tickets when one of these users are found. This can be adjusted to find users created in a rang...
Guest about 1 year ago in Microsoft 365 0

Roar: Failed Active Directory Inspectors List

List of Active Directory inspectors failing
Kevin Fuller over 1 year ago in Active Directory 0

Microsoft 365 : Malicious Application Consent - Padlet

This application has actively been used during account compromises to create a backup of the accounts mailbox.Create an actionable alert for this and audit all environments.
Jordan Docter about 1 year ago in Microsoft 365 0

Active Directory: Remote Desktop Users Summary

Returns a list of the member names that belong to the Remote Desktop Users group. Modifications to this list can indicate a potential security vulnerability. An accompanying Alert can be created that sets the "changed" threshold against this metric.
Paul Taplett over 1 year ago in Active Directory 0

Active Directory: List of Enabled Group Policies

This metric will list the applied GPO's from an Active Directory server
Lamont Largie almost 3 years ago in Active Directory 0

Windows Server: AV/EDR - Sophos, Huntress, Defender Installed

Windows Server: Software Compliance - Sophos, Huntress, Defender Installed Category: Software Compliance Description: This metric pulls a list of all installed software from endpoints, specifically filtering for security-related software such as S...
Lamont Largie 7 months ago in Windows Server 0

Microsoft 365: Licenced Mailbox User

Lists all users with a licenced mailbox (not all data prints can use the "?Has_Exchange_License == `True`" due to type of licence and graph permissions!!) Can be turned into a count with length(@) Can also separate enabled and disabled with "&...
Austin B [QuoStar] over 2 years ago in Microsoft 365 0

Microsoft 365: Percent of Storage Used over 90

Checks for Storage_Used existing, then any users with over 90% storage used, then prints the name and amount of storage used
Leland Shane almost 3 years ago in Microsoft 365 0

Office 365: Visio Online (Plan 2) Active License Count

Visio Online (Plan 2) Active License Count
Matthew Waddell almost 2 years ago in Microsoft 365 0