Metrics Library

This metric will assess whether your workstations are compatible with the upgrade to Windows 11. contains(OS.OperatingSystemName, Microsoft Windows 10 ) && OS.Windows11Compatible == false && No || Yes

Identifies if the last logged in user is a member of the "Administrators" group. Returns 'true' or 'false' contains(Groups[?SID== S-1-5-32-544 ].Members[], ComputerSystem.LastLoggedInUser)

Identifies if BitLocker is enabled on an operating system drive. Returns 'true' or 'false' Drives[?VolumeType == 'OS Volume'].[BitlockerStatus == 'Fully Encrypted']

Creates a list of the users in the "Administrators" group, allows for change detections to be alerted on for this as well, of course. Users[?contains(Groups, Administrators )].Name

Displays the current version of ThreatLocker installed on a Windows Workstation Software[?contains(Name, ThreatLocker )].join( : , [Name,Version])

Replace the "xxxxxxxxxxxxxxxx" with your known ScreenConnect fingerprints. You can add additional fingerprints as needed with more "contains" statements separated by "||". These fingerprints can be found via software inventory (Add/Remove Programs, RMM, Liongard, etc). Look for the ScreenConnect entries and grab the 16-character string. Software[?contains(Name, ScreenConnect ) && !(contains(Name, xxxxxxxxxxxxxxxx ) || contains(Name, xxxxxxxxxxxxxxxx ))].join( : , [Name,DisplayVersion]) | sort(@)

This metric provides a more readable output when used in the Software Inventory (CIS V8 Control 2.1) Report Template. Software[?!(contains(Name, Update ))].[Name, Version: DisplayVersion]

Shows list of missing software updates over 14 days old which have a severity rating associated. (Cyber Essential Requirement in UK)add "| length(@)" to turn into a count of updates over X days AvailableUpdates[?time_since(LastDeploymentChangeTime, days )> 14 && MsrcSeverity != null && Type == Software ].Title

Returns the current installed version of Google Chrome slice_string(to_string(Software[?Name == 'Google Chrome'].Version), 2, -2 )

By using the "is not empty" condition, this metric allows you to build an Actionable Alert in order to detect if a Windows Workstation is running a version of Google Chrome equal to or earlier than 116.0.5845.187 Software[?Name == 'Google Chrome' && version_compare(Version, <= , 116.0.5845.187 )].Version