Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

All Metric entries

Showing 880 of 880

Office 365: Stale Mailboxes

Lists active stale users that are licensed with a mailbox and haven't been active in 30 days.
Dominic Peterson 4 months ago in Microsoft 365 0

Google Workspace: Stale User List with Exclusions

This metric supports the RoarExclude group filter. The RoarExclude group filter will prevent alerts from triggering for users who are part of the RoarExclude group. To utilize this feature, you will need to create a Group named “RoarExclude” in th...
Michael Thompson 4 months ago in Google Workspace 0

Active Directory: Never Used User Accounts Created Over 30 Days Ago Summary

This metric will list all accounts created over 30 days ago that have not been logged into.
Michael Thompson 5 months ago in Active Directory 0

Internet Domain/DNS: Multiple SPF Records

This is actually a built in metric, but it can be used to detect when multiple SPF records are defined by the following alert rule: Metric: Internet Domain/DNS: SPF Records (SPFRecord metric)Operator: containsThreshold: ,v=spf1
Darren White 5 months ago in Internet Domain/DNS 0

Azure Active Directory: Conditional Access Policies with Excluded Users Summary

I based this off another metric created by David Chapman, so thanks to him for the original idea! I added the ability to also bring in users from excluded groups for a full picture of what users are excluded from CA policies. There might be a more...
Noah Tatum 5 months ago in Azure Active Directory 0

Azure Active Directory: List of MFA Conditional Access Policies applied to ANY Application

Returns a list of CA policies applied to ANY application in Azure Active Directory
Lamont Largie 6 months ago in Azure Active Directory 0

OneLogin: Active User Count

Count of users that are actively licensed in OneLogin
Robert Herbaugh 7 months ago in OneLogin 0

OneLogin: MFA Not Enrolled Users

Used to list users that do not have any MFA devices enrolled
Robert Herbaugh 7 months ago in OneLogin 0

Windows Workstation: Missing Severity Software Updates over 14 days

Shows list of missing software updates over 14 days old which have a severity rating associated. (Cyber Essential Requirement in UK) add "| length(@)" to turn into a count of updates over X days
Austin B [QuoStar] 7 months ago in Windows Workstation 0

Windows Workstation: Google Chrome Version

Returns the current installed version of Google Chrome
Paul Taplett 8 months ago in Windows Workstation 0