Skip to Main Content
Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and
follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.

🥴 See something off? Open a support chat to let us know.


All Metric entries

Showing 883 of 883

Duo Security : Account ID List

This metric lists all the child account id's and the account name.
Michael Thompson 2 months ago in Duo Security 0

Google Workspace: Stale User List with Exclusions

This metric supports the RoarExclude group filter. The RoarExclude group filter will prevent alerts from triggering for users who are part of the RoarExclude group. To utilize this feature, you will need to create a Group named “RoarExclude” in th...
Michael Thompson 5 months ago in Google Workspace 0

Microsoft 365: Count of All Group Members

This metric displays a count of all active group members.
Michael Thompson 3 months ago in Microsoft 365 0

Duo Security Users No Activity for greater than 7 days

Days can be modified to whatever you wish
Shawn Meyer 3 months ago in Duo Security 0

Active Directory: Never Used User Accounts Created Over 30 Days Ago Summary

This metric will list all accounts created over 30 days ago that have not been logged into.
Michael Thompson 6 months ago in Active Directory 0

Internet Domain/DNS: Multiple SPF Records

This is actually a built in metric, but it can be used to detect when multiple SPF records are defined by the following alert rule: Metric: Internet Domain/DNS: SPF Records (SPFRecord metric)Operator: containsThreshold: ,v=spf1
Darren White 6 months ago in Internet Domain/DNS 0

M365: AAD App Secrets Expiring within 30 days

Looks for applications with expiring/expired secrets (within 30 days), then outputs the Application name, and the secrets associated that are expiring/expired.
Leland Shane about 1 year ago in Microsoft 365 0

Azure Active Directory: Conditional Access Policies with Excluded Users Summary

I based this off another metric created by David Chapman, so thanks to him for the original idea! I added the ability to also bring in users from excluded groups for a full picture of what users are excluded from CA policies. There might be a more...
Noah Tatum 6 months ago in Azure Active Directory 0

Internet Domain/DNS: DMARC present but set to "None

This metric will reveal if a domain has DMARC available but the action is set to None . Below are the possible outputs of the metric. No DMARC Found (self-explanatory) True = DMARC is present but the action is set to “none” False = The domain is n...
De'Shard Brown 3 months ago in Internet Domain/DNS 0

Azure AD: Complete List of Conditional Access Policies and Excluded Users

This metric will return a complete list of Azure AD Conditional Access policies and a list of excluded users for each policy. This is difficult because the policies only contain a list of user's ID, not their display names.
David Chapman about 1 year ago in Azure Active Directory 1