Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

All Metric entries

Showing 917 of 917

Microsoft 365: Active Email Addresses and Aliases by User (No Guest Accounts)

A list of emails addresses in use by user.
Kevin Fuller over 1 year ago in Microsoft 365 0

Internet Domain/DNS: SPF Soft Fail

Find SPF records that are set to 'Soft Fail' with '~all' instead of the best practice 'Hard Fail' with '-all'
Eric Vollbrecht over 2 years ago in Internet Domain/DNS 0

Roar: Failed Active Directory Inspectors List

List of Active Directory inspectors failing
Kevin Fuller over 1 year ago in Active Directory 0

Windows Workstation: Last Logged In User has Local Admin Permissions?

Identifies if the last logged in user is a member of the "Administrators" group. Returns 'true' or 'false'
Henri Pitkänen almost 2 years ago in Windows Workstation 0

Windows Workstation: Is BitLocker Enabled on an OS Drive?

Identifies if BitLocker is enabled on an operating system drive. Returns 'true' or 'false'
Henri Pitkänen almost 2 years ago in Windows Workstation 0

Active Directory: Never Used User Accounts Created Over 30 Days Ago Summary

This metric will list all accounts created over 30 days ago that have not been logged into.
Michael Thompson 11 months ago in Active Directory 0

Internet Domain/DNS: Multiple SPF Records

This is actually a built in metric, but it can be used to detect when multiple SPF records are defined by the following alert rule: Metric: Internet Domain/DNS: SPF Records (SPFRecord metric)Operator: containsThreshold: ,v=spf1
Darren White 11 months ago in Internet Domain/DNS 0

Windows Workstation: Unauthorized AnyDesk Installation (Last 7 Days)

Metric Name: Windows Workstation: Unauthorized AnyDesk Installation (Last 7 Days) Category: Windows Workstation Description: This metric identifies and reports recent installations of AnyDesk on Windows workstations that may not have been authoriz...
Lamont Largie 6 months ago in Windows Workstation 0

Active Directory: Remote Desktop Users Summary

Returns a list of the member names that belong to the Remote Desktop Users group. Modifications to this list can indicate a potential security vulnerability. An accompanying Alert can be created that sets the "changed" threshold against this metric.
Paul Taplett over 1 year ago in Active Directory 0

Active Directory: Count of Users Assigned to Group(s)

Returns the number of users assigned to a group.
Erik Zwep over 2 years ago in Active Directory 0