Feature Requests

Imagine we have the same metric for 2 customers, but wish to send notifications to 2 different Microsoft Teams channels (it can receive an e-mail). This would be used for informational things like a group policy was added to Active Directory and has to go to the customer team handling that environment. We also have the scenario where we wish to create a notification for a metric across all customers that go to a single destination - in our case, a PSA ticket mailbox.

Actionable alerts currently generate when an inspector runs - being able to set a threshold before it sends to the PSA would enhance integration and reduce alert noise to the PSA.Examples:Host snapshots: could be open for maintenance, but the same snapshot only need to raise PSA ticket/alert if open for more than X days.Windows Workstations mandatory patches: mandatory patch might be open one day, but the expectation it is installed within X days - so only want to raise a ticket after X days.

We are building out a reporting process that pulls data from Liongard for QBR like meetings, it would be nice to review all environment changes with a customer as a part of that process, but you don't expose that data to be pulled via API.

Currently the Stale value is set when the last login was greater than 30 days ago. Objective: Be able to modify this value per enviornment to allow the ability to customize the alerts generated, This way if partners have clients that want to monitor stale accounts over 60 days or greater. The benefit of being able to modify this on a gloabl per enviornment basis is you won't need to create custom metric for each new client or new requirement that the partners need.

With the ability to report on Brute Force Attacks through the Actionable Alerts, it would be beneficial to search on a previous 24 hour basis. This would allow notifications of only the attacks recently seen. The ticket can be resolved and only notified of the new attacks. Currently, for one client I have attacks going back to 2011. The way to reset the counter is to login with the account. This is less than ideal. The ability to also review Brute Force Attacks over a time period would be of benefit as well for reporting purposes.

I would love to be able to batch close multiple alerts at once. Currently, we only have the ability to close alerts through the Action dropdown, but they reopen. Mayne of these alerts are several years old and need to be purged, but there are around 600, too many to do manually.

It would be great to get notified of issues that LG is having with inspectors if we have that inspector enabled. This way we are aware and do not need to open tickets or can take appropriate action on the client side. Example of this would be to get notified of an issue with the M365 inspector where there is an issue with the external forwarding rule notification. Not knowing there is an issue with LG makes it very difficult to count on LG to be our tool to alert us.

I would like to ignore event alerts on a per event basis. This should allow a particular event or condition to still be in a triggered state but Liongard to not send further alerts to ticketing (Manage or otherwise). For example, if a user has "anomalyous login activity" or a failed login, it can create a ticket for that user. If we close that ticket in Manage or "ignore" it in Liongard (even though there has not been a successful login to reset the alert condition) Liongard should accept closure of the ticket without repeatedly reopening it.Once the alert condition has cleared, that event is complete and Liongard should reset monitoring and create a new ticket (or potentially reopen the old one) if the monitor THEN enters a failed state again.

Example: User Accounts with Brute Force Attempts: Guest, Bad Login Attempts:260Would like more details where these attempts is coming from like ip address where these attempts are made. Where is this data getting pulling from.

We use email notifications for alerting and a feature suggestion is to be able to customize the emails sent from Liongard. Specifically, we are looking for a way to add the Environment name to the Subject, but being able to send specific alerts to specific email addresses and add different information to the email would be helpful. I see there are ways to adjust the Alert information that would go into the Email body but we're looking to adjust the email recipients and Email Subject information.