Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

All Metric entries

Showing 919 of 919

Windows Workstation: Unknown ScreenConnect Fingerprints

Replace the "xxxxxxxxxxxxxxxx" with your known ScreenConnect fingerprints. You can add additional fingerprints as needed with more "contains" statements separated by "||". These fingerprints can be found via software inventory (Add/Remove Programs...
Noah Tatum 9 months ago in Windows Workstation 1

Windows Server: Unknown ScreenConnect Fingerprints

Replace the "xxxxxxxxxxxxxxxx" with your known ScreenConnect fingerprints. You can add additional fingerprints as needed with more "contains" statements separated by "||". These fingerprints can be found via software inventory (Add/Remove Programs...
Noah Tatum 9 months ago in Windows Server 2

Microsoft 365: New users created 7 days ago with MFA disabled

This metric will allow you to find M365 users created 7 days ago and MFA is Disabled. We are using this metric along with an actionable alert to create tickets when one of these users are found. This can be adjusted to find users created in a rang...
Guest 9 months ago in Microsoft 365 0

Microsoft 365: Nonprofit License Excluding Donated Licenses

Use this query when syncing nonprofit licenses. You can change the consumedUnits that are subtracted depending on the donated licenses.
Phil at Gradient MSP almost 2 years ago in Microsoft 365 0

Azure Active Directory: Conditional Access Policy - Block Legacy Authentication - Name & State

Searches for Conditional Access Policies that contain "legacy authentication" in it's name and returns the current state of the found CA Policy. Use Cases: Can be used in Identifying if the default Microsoft Policy titled "Block legacy authenti...
Lamont Largie over 2 years ago in Azure Active Directory 1

Microsoft 365 : Malicious Application Consent - Padlet

This application has actively been used during account compromises to create a backup of the accounts mailbox.Create an actionable alert for this and audit all environments.
Jordan Docter 10 months ago in Microsoft 365 0

Duo Security: Disabled Users

Grab all users who are showing as disabled.
Matthew Waddell over 1 year ago in Duo Security 0

Datto RMM : Device Offline > 30 Days

List of Devices that have not checked in > 30 days
Lamont Largie over 2 years ago in Datto RMM 0

Microsoft 365: Maximum Secure Score

Returns the maximum secure score possible for the tenant.
Paul Taplett about 2 years ago in Microsoft 365 0

Active Directory: Summary of Enabled Group Policies

This metric will list all of the enabled group policies when applied to an Active Directory inspector. It will also return the following: Is the policy is detached (T/F) Is the policy enabled for users (T/F) Is the policy enabled for computers (T/F)
Lamont Largie over 2 years ago in Active Directory 0