Feature Requests

Request from Joseph Pena, "We use Duo, so the MFA alerts for Office 365 alert on every user. Is there any way you could look for a conditional access policy for Duo?"

Would like to see the ability to pull the flag if a job not only doesn't run but attempts to run and fails. It would be nice most people use email monitoring which is prone to failure as well.

In Office365 and Google Workspace, there exists the concept of shared mailboxes, distribution lists, m365 native groups, etcIt would be good to have these as configurations in IT Glue so that we can track changes to these group mailboxes with tickets.

Would be nice to have an alert template that could alert the user directly to change their password if they have recently been found in a breach.

This would be a compliance check or onboarding control to make sure that this is enabled to avoid any data-loss. https://docs.microsoft.com/en-us/onedrive/retention-and-deletion#configure-automatic-access-delegation

Currently, we get alerts when the clock-period is adjusted for a router or switch via ntp servers. To us, this doesn't count as something we want to be alerted on. We'd like to exclude these types of changes from triggering alerts. As jmespath doesn't appear to have the ability to replace data incoming from the inspector, I don't believe a custom metric will work here. Rather, I think we would need an additional path added to the Cisco IOS inspecter , maybe clone the existing RunningConfig path (call it something like RunningConfigExcludesNTPClockPeriod). I believe the IOS command below would exclude those changes prior to ingestion by LionGard, to limit the amount of customization that would need to be done on the inspector side.show running-config | exclude clock-period

We have change notifications sent to Microsoft Teams via webhook, but we often see notifications like "Count of Joined Computers Changed" in "Active Directory". Here we see the count increasing, but we cannot see for example the device names. Even when going to the alert, we cannot see what device names. It makes the notification almost useless. The recommended action from the notification is "Action: Review the Computers Joined to the Domain and Verify that the Computers that have been Removed and/or Added were Approved, and have been Documented According to Best Practices." which is impossible without contextual data.

This is useful as it means or IT Glue environment will be more secure and help us with any security breaches.

To have a better view over the alerts list, the default view should hide closed alerts.

Have the Network IP Inspector check for the IP appearing on Blacklists and alerting such