Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and take a course on how to write them from Liongard Academy!
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

All Metric entries

Showing 971 of 971

Active Directory: User Accounts With Brute Force Attempts Count 5+ Count

Current Brute force metric alerts after 4 failed attempts even on disabled accounts from multiple years ago. This provides a custom option to be closer to the lockout policy with the option of monitoring only enabled accounts. This provides a coun...
Devon over 3 years ago in Active Directory 1

Sonicwall: NAT contains RDS services

This one is a little trickier to catch but looks for the translated service containing RDP, RDS, Terminal, or 3389 with source being any. This is an indicator of wide open RDP however if the service does not contain these names it is missed.
Devon over 3 years ago in SonicWall 0

Azure Active Directory: InTune registered devices with Encryption disabled

Detects corporate intune registered devices not encrypted. Outputs into CSV friendly format
Austin B [QuoStar] over 3 years ago in Azure Active Directory 0

Sonicwall: Exposed IKE/VPN

Detects IKE connections with ANY as the source IP.
Austin B [QuoStar] over 3 years ago in SonicWall 0

Roar Inspector: Agents which have not checked in, in the last 6 hours

Useful to know when agents have stopped communicating and probably need a Liongard windows service restart.
Nick Dechnik over 3 years ago in Roar 0

Active Directory: Display Names of DNS Forward Lookup Zones

This can be useful if needing all forward lookup zones for DNS filtering platforms such as Cisco Umbrella where all lookup zones need to be accounted for.
Nick Dechnik over 3 years ago in Active Directory 0

Cisco Umbrella: Public Networks

Will display a list of all public networks configured and verified on the customers Umbrella tenant.
Nick Dechnik over 3 years ago in Cisco Umbrella 0

Office 365: Microsoft 365 A3 Assigned Licenses Count

Provide count of Microsoft 365 Academic Licensing - A3
Jai Dametto over 3 years ago in Microsoft 365 0

Cisco ASA: ASDM Version

Determines the ASDM image that is installed on the device.
Robbie Kibler over 3 years ago in Cisco ASA 0

Cisco IOS: Syslog Detected

Determines if the device is logging to an external syslog server.
Robbie Kibler over 3 years ago in Cisco ASA 1