Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

All Metric entries

Showing 910 of 910

Windows Workstation: Unknown ScreenConnect Fingerprints

Replace the "xxxxxxxxxxxxxxxx" with your known ScreenConnect fingerprints. You can add additional fingerprints as needed with more "contains" statements separated by "||". These fingerprints can be found via software inventory (Add/Remove Programs...
Noah Tatum 8 months ago in Windows Workstation 1

Windows Server: Unknown ScreenConnect Fingerprints

Replace the "xxxxxxxxxxxxxxxx" with your known ScreenConnect fingerprints. You can add additional fingerprints as needed with more "contains" statements separated by "||". These fingerprints can be found via software inventory (Add/Remove Programs...
Noah Tatum 8 months ago in Windows Server 2

Microsoft 365: New users created 7 days ago with MFA disabled

This metric will allow you to find M365 users created 7 days ago and MFA is Disabled. We are using this metric along with an actionable alert to create tickets when one of these users are found. This can be adjusted to find users created in a rang...
Guest 8 months ago in Microsoft 365 0

AAD:Active Users Without MFA (Not Disabled)

Allow you to easily identify users with MFA enabled that are not disabled accounts.
Jai Dametto about 3 years ago in Azure Active Directory 1

Microsoft 365: Exchange Licensed user w/ 95% full mailbox

Outputs percentage of Storage used against full mailbox size in addition to the email address and mailbox size. Microsoft's built in warning to the user is at 98%, Prohibits sending at 99%, and Prohibits receiving at 100%. This can be customized b...
Devon almost 2 years ago in Microsoft 365 2

Windows Workstation: Unauthorized AnyDesk Installation (Last 7 Days)

Metric Name: Windows Workstation: Unauthorized AnyDesk Installation (Last 7 Days) Category: Windows Workstation Description: This metric identifies and reports recent installations of AnyDesk on Windows workstations that may not have been authoriz...
Lamont Largie 4 months ago in Windows Workstation 0

Microsoft 365 : Malicious Application Consent - Padlet

This application has actively been used during account compromises to create a backup of the accounts mailbox.Create an actionable alert for this and audit all environments.
Jordan Docter 8 months ago in Microsoft 365 0

Active Directory: Last Login with Timestamp

This will return us the last logon for the AD user.
_ _ over 2 years ago in Active Directory 1

Azure AD: Complete List of Conditional Access Policies and Excluded Users

This metric will return a complete list of Azure AD Conditional Access policies and a list of excluded users for each policy. This is difficult because the policies only contain a list of user's ID, not their display names.
David Chapman over 1 year ago in Azure Active Directory 1

Microsoft 365: Privileged User w/ License

Best Practices are for admin accounts to not contain a license unless required. This metric outputs Privileged users and what products they are assigned
Devon about 3 years ago in Microsoft 365 0