Skip to Main Content
Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and
follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

All Metric entries

Showing 883 of 883

Azure Active Directory: Days Since Last AADC Sync

Counts the number of days since the last Azure Active Directory Connect (AADC) sync. Useful for determining if there is an issue as it should always be <1.
Robbie Kibler almost 3 years ago in Azure Active Directory 6

Windows Workstation: Unknown ScreenConnect Fingerprints

Replace the "xxxxxxxxxxxxxxxx" with your known ScreenConnect fingerprints. You can add additional fingerprints as needed with more "contains" statements separated by "||". These fingerprints can be found via software inventory (Add/Remove Programs...
Noah Tatum 4 months ago in Windows Workstation 1

Windows Server: Unknown ScreenConnect Fingerprints

Replace the "xxxxxxxxxxxxxxxx" with your known ScreenConnect fingerprints. You can add additional fingerprints as needed with more "contains" statements separated by "||". These fingerprints can be found via software inventory (Add/Remove Programs...
Noah Tatum 4 months ago in Windows Server 2

Microsoft 365: New users created 7 days ago with MFA disabled

This metric will allow you to find M365 users created 7 days ago and MFA is Disabled. We are using this metric along with an actionable alert to create tickets when one of these users are found. This can be adjusted to find users created in a rang...
Guest 4 months ago in Microsoft 365 0

Palo Alto | CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect

This metric will be used to detect affected versions for the below CVE. The metric will return true or false if the system is running an affected version. https://security.paloaltonetworks.com/CVE-2024-3400 This issue is fixed in hotfix releases o...
Austin Unger about 2 months ago in Palo Alto 1

macOS: Huntress Installed

This will return a true or false value for the installation of Huntress
De'Shard Brown 6 months ago in macOS 0

Microsoft 365 : Malicious Application Consent - Padlet

This application has actively been used during account compromises to create a backup of the accounts mailbox.Create an actionable alert for this and audit all environments.
Jordan Docter 4 months ago in Microsoft 365 0

SonicWall: Active Licenses Expiring in 90 days

This metric works for Gen 7 firewalls and returns a list of all active licenses that are going to expire in the next 90 days.
Justin Penchina 6 months ago in SonicWall 0

Auvik: List of Actual Billable Devices

Auvik only bills you for core billable devices (Firewalls, Routers, Switches, and Cisco Wireless Cloud Controllers). The problem is, you can also unmanage a device (if it's not a important device). This metric will account for any core device t...
Jason Bandy 2 months ago in Auvik 0

Auvik: Count of Actual Billable Devices

Auvik only bills you for core billable devices (Firewalls, Routers, Switches, and Cisco Wireless Cloud Controllers). The problem is, you can also unmanage a device (if it's not a important device). This metric will account for any core device then...
Jason Bandy 2 months ago in Auvik 0