Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

Microsoft 365

Showing 114 of 878

Microsoft 365: Count of All Group Members

This metric displays a count of all active group members.
Michael Thompson 25 days ago in Microsoft 365 0

Microsoft 365 : Malicious Application Consent - Padlet

This application has actively been used during account compromises to create a backup of the accounts mailbox.Create an actionable alert for this and audit all environments.
Jordan Docter 2 months ago in Microsoft 365 0

Microsoft 365 : Malicious Application Consent - PerfectData

This application has actively been used during account compromises to create a backup of the accounts mailbox.Create an actionable alert for this and audit all environments.
Devon about 1 year ago in Microsoft 365 1

Office 365: Stale Mailboxes

Lists active stale users that are licensed with a mailbox and haven't been active in 30 days.
Dominic Peterson 3 months ago in Microsoft 365 0

M365: PerfectData App Check

Malicious actors are utilizing a vulnerability with the "PerfectData Software" Entra(AKA Azure) enterprise application. This metric can query each M365 inspector and display whether or not the app is present in the tenant. This can be used with ou...
David Chapman about 2 months ago in Microsoft 365 1

Microsoft 365: Shared Mailbox Listing

This metric displays a list of the names of the shared mailboxes.
Michael Thompson about 2 months ago in Microsoft 365 0

Microsoft 365: Shared Mailbox Count

This metric displays a count of shared mailboxes.
Michael Thompson about 2 months ago in Microsoft 365 0

Microsoft 365: New users created 7 days ago with MFA disabled

This metric will allow you to find M365 users created 7 days ago and MFA is Disabled. We are using this metric along with an actionable alert to create tickets when one of these users are found. This can be adjusted to find users created in a rang...
Guest about 2 months ago in Microsoft 365 0

M365: AAD App Secrets Expiring within 30 days

Looks for applications with expiring/expired secrets (within 30 days), then outputs the Application name, and the secrets associated that are expiring/expired.
Leland Shane almost 1 year ago in Microsoft 365 0

Microsoft 365: Exchange Licensed user w/ 95% full mailbox

Outputs percentage of Storage used against full mailbox size in addition to the email address and mailbox size. Microsoft's built in warning to the user is at 98%, Prohibits sending at 99%, and Prohibits receiving at 100%. This can be customized b...
Devon over 1 year ago in Microsoft 365 2