Metrics Library

Counts the number of days since the last Azure Active Directory Connect (AADC) sync. Useful for determining if there is an issue as it should always be <1. SystemInfo.DirectorySync[?DaysSinceLastSync_r > 0 ] | length(@)

Looks for applications with expiring/expired secrets (within 30 days), then outputs the Application name, and the secrets associated that are expiring/expired. Applications[?passwordCredentials[?time_until(endDateTime, days ) < 30 ].endDateTime].['Application Name: 'displayName, 'Secret Name: 'passwordCredentials[?time_until(endDateTime, days ) < 30 ].displayName]

This application has actively been used during account compromises to create a backup of the accounts mailbox.Create an actionable alert for this and audit all environments. ServicePrincipals[?appId== ff8d92dc-3d82-41d6-bcbd-b9174d163620 ].join( , [join( , [ , to_string(appDisplayName)]), join( , [ : , to_string(createdDateTime)])])

This Metric is great for Reports (QBRs and Licensing Audits) and gaining and sharing granular visibility into user's licensing status. Users[? accountEnabled == true && Assigned_Products != ` ].join( , [join( , [ , to_string(displayName)]), join( , [ : `, to_string(Assigned_Products)])]) | sort(@)

Allow you to easily identify users with MFA enabled that are not disabled accounts. Users[?accountEnabled == true && isMfaRegistered_r== Disabled ].userPrincipalName

This will return us the last logon for the AD user. Users[].join( , [join( , [ AD LOGIN: , to_string(UserName)]), join( , [ . Name of User: , to_string(Name)]),join( , [ : , to_string(LastLogonDate)])])

Name of DHCP in over 80% to be used for alerting DHCP.Serverv4Scopes[?Statistics.PercentageInUse >= to_number('80')].Name

Best Practices are for admin accounts to not contain a license unless required. This metric outputs Privileged users and what products they are assigned Users[?Privileged== Yes && Assigned_Products != ` ].join( , [join( , [ , to_string(displayName)]), join( , [ : `, to_string(Assigned_Products)])]) | sort(@)

Patching devices is a critical component to CyberSecurity. Ensuring products are patched and updated, this metric shows you the current version and the available update with Fortigate version 7.x [DeviceVersion 'Current Version |' Firmware.current.version 'Available | 'Firmware.available[0].version]

This is helpful to someone who's trying to obtain/maintain visibility into a part of the breakdown of an AD password policy at an organization. This is a good Metric for QBRs, recurring site reviews, and an onboarding report. This Metric can also be used to create a pointed Actionable Alert that prompts the proper maintanence of a secure AD passpord policy. Users[? PasswordNeverExpires == true ].Name