Liongard Library

Welcome to Liongard Library, where Lions share! This is a community-led space where Liongard users can come to teach and learn from one another.
Share custom Metrics, get inspired and see what’s trending in the Pride.

Pride Etiquette:
➕ Have great custom Metrics? Add them as entries!
🌟 Want to use a Metric? Copy the query and follow this doc.
👍 Tried a Metric from the Library? Like it!
📣 Have a question or feedback on a Metric? Add a comment!
🔎 Not sure where to start? Learn about Metrics and how to write them.
💬 Need help writing a metric or want to help support others? Join the conversation in our Liongard Lounge #metrics slack channel.


🥴 See something off? Open a support chat to let us know.

ADD A NEW METRIC ENTRY

All Metric entries

Showing 910 of 910

Azure Active Directory: Days Since Last AADC Sync

Counts the number of days since the last Azure Active Directory Connect (AADC) sync. Useful for determining if there is an issue as it should always be <1.
Robbie Kibler about 3 years ago in Azure Active Directory 6

Microsoft 365 : Malicious Application Consent - PerfectData

This application has actively been used during account compromises to create a backup of the accounts mailbox.Create an actionable alert for this and audit all environments.
Devon over 1 year ago in Microsoft 365 1

AAD:Active Users Without MFA (Not Disabled)

Allow you to easily identify users with MFA enabled that are not disabled accounts.
Jai Dametto about 3 years ago in Azure Active Directory 1

Microsoft 365: Privileged User w/ License

Best Practices are for admin accounts to not contain a license unless required. This metric outputs Privileged users and what products they are assigned
Devon about 3 years ago in Microsoft 365 0

Microsoft 365: Users w/ Associated Licenses

This Metric is great for Reports (QBRs and Licensing Audits) and gaining and sharing granular visibility into user's licensing status.
Addison Caldwell about 3 years ago in Microsoft 365 0

Active Directory: DHCP Percent In Use over 80

Name of DHCP in over 80% to be used for alerting
Kevin Fuller over 3 years ago in Active Directory 1

M365: AAD App Secrets Expiring within 30 days

Looks for applications with expiring/expired secrets (within 30 days), then outputs the Application name, and the secrets associated that are expiring/expired.
Leland Shane over 1 year ago in Microsoft 365 0

Active Directory: Last Login with Timestamp

This will return us the last logon for the AD user.
_ _ over 2 years ago in Active Directory 1

Fortigate: Show DeviceVersion, Current Firmware and Available Firmware

Patching devices is a critical component to CyberSecurity. Ensuring products are patched and updated, this metric shows you the current version and the available update with Fortigate version 7.x
Scott Davis almost 2 years ago in Fortinet FortiGate 0

[Microsoft 365: Non-Admin, Non-Guest, License Assigned, MFA disabled]

This query looks for non-admin users who have an active license within your organization that do not have MFA enabled (ignoring guest users).
Charles Van Duynhoven almost 3 years ago in Microsoft 365 5