Metrics Library

Counts the number of days since the last Azure Active Directory Connect (AADC) sync. Useful for determining if there is an issue as it should always be <1. SystemInfo.DirectorySync[?DaysSinceLastSync_r > 0 ] | length(@)

This metric checks if the current firmware version is older than the latest available version marked as 'Mature'. It first ensures both versions are not null to prevent false positives caused by missing data (a known issue in some Liongard inspectors). If valid, it compares the versions numerically. The metric returns true when an update is available. Data Print Query: not_null(Firmware.current.version) && not_null(sort_by(Firmware.available[?maturity=='M'], &id)[-1].version) && to_number( join('', [ replace(split(sort_by(Firmware.available[?maturity=='M'], &id)[-1].version, '.')[0], 'v', ''), split(sort_by(Firmware.available[?maturity=='M'], &id)[-1].version, '.')[1], split(sort_by(Firmware.available[?maturity=='M'], &id)[-1].version, '.')[2] ]) ) > to_number( join('', [ replace(split(Firmware.current.version, '.')[0], 'v', ''), split(Firmware.current.version, '.')[1], split(Firmware.current.version, '.')[2] ]) )

This is helpful to someone who's trying to obtain/maintain visibility into the admin users in an organization's M365 instance. This is a good Metric for QBRs, recurring site reviews, and an onboarding report. Also, this Metric could be used to build a user audit with the intention of an end customer confirming that all looks as expected. This Metric can also be used to create a pointed Actionable Alert that helps to maintain visibility into changes to this list. Roles[? contains(displayName, dmin ) && displayName != Company Administrator && Members[] != null && Members[] != [] ].join( , [join( , [ , to_string(displayName)]), join( , [ : , to_string(Members[].displayName)])])

This is helpful to someone who's trying to obtain/maintain visibility into the non-admin users in an organization's M365 instance. This is a good Metric for QBRs, recurring site reviews, and an onboarding report. Also, this Metric could be used to build a user audit with the intention of an end customer confirming that all looks as expected. This Metric can also be used to create a pointed Actionable Alert that helps to maintain visibility into changes to the list of Admin users with MFA disabled. Users[? Privileged == Yes && isMfaRegistered_r == Enabled ].displayName

This metric will reveal if a domain has DMARC available but the action is set to None . Below are the possible outputs of the metric.No DMARC Found (self-explanatory)True = DMARC is present but the action is set to “none”False = The domain is not impacted (DMARC is present and it either has the reject or archive action) DMARCRecord && contains(DMARCRecord, p=none ) || DMARCExists == false && No DMARC Found

Category: Storage Insights MetricsDescription:This metric generates a comprehensive summary of Microsoft 365 drive storage details. It includes key information such as site name, drive name, creator, creation date, and the remaining storage percentage for each drive.Purpose:To provide IT organizations with a clear and concise overview of storage utilization across Microsoft 365 environments, enabling better management, planning, and resolution of storage-related issues.Use Cases:Resource Monitoring: Keep track of storage utilization across all drives to ensure sufficient capacity is available.Capacity Planning: Use remaining storage data to plan for upgrades or archival actions, ensuring continued system performance.Accountability: Identify the owner (Created By) of drives to facilitate follow-ups for cleaning or optimizing storage.Auditing: Document drive creation dates and usage trends to support audits and compliance efforts.Optimization Opportunities: Highlight drives with very high or very low usage for potential cleanup or reallocation.How it Works:The metric utilizes Liongard’s Microsoft 365 Inspector to extract and summarize storage-related data for each drive. The JMESPath query outputs the following details for every drive:Site NameDrive NameCreated By (Owner)Created On (Date of Creation)Remaining Storage in PercentageBeneficiaries:IT Teams: Gain insights into storage usage across all sites and drives.Organizations: Plan for future storage needs and maintain efficient operations.Decision-Makers: Access actionable summaries to guide resource allocation and policy adjustments.Notes for Customization:Additional Enhancements:Add Usage Details: Include fields like Used Storage or Total Capacity to provide a fuller picture of the drive’s storage status.Highlight Critical Drives: Apply conditional formatting or flags for drives with less than a specified threshold of remaining storage (e.g., 10%).Aggregate Data: Create summary statistics, such as total remaining storage or average usage across all drives.Why Modify:Tailored Reporting: Customize the fields and output to align with organizational needs, such as compliance with specific storage policies.Enhanced Usability: Expand data points to allow quicker decision-making, such as identifying which drives to prioritize for cleanup or migration.Automation Opportunities: Tie the metric to workflows that notify teams of critical storage issues or trigger cleanup operations. drives[].[['Site Name:'siteName_r],['Name:'name],['Created By:' createdBy.user.displayName],['Created On:'createdDateTime],['Remaining Storage in %:'quota.percentOfQuotaRemaining_r],['--']][]

This will return us the last logon for the AD user. Users[].join( , [join( , [ AD LOGIN: , to_string(UserName)]), join( , [ . Name of User: , to_string(Name)]),join( , [ : , to_string(LastLogonDate)])])

Total count for devices with OS type "Server". Devices[?Settings.OSType=='Server'].Settings | length(@)

Total count of devices with OS type "Workstation". Devices[?Settings.OSType=='Workstation'].Settings | length(@)

Category: Email Security and Domain ManagementDescription:This metric retrieves the Sender Policy Framework (SPF) record for domains managed in the Internet Domain/DNS inspector. It provides details about authorized email senders, ensuring better email authentication and protection against spoofing attacks.Purpose:To validate SPF records and ensure email sender policies are correctly configured for each domain.To prevent email spoofing and improve domain reputation through proper email security configurations.To ensure compliance with email authentication standards like DMARC.How it Works:Queries the EmailSecurityOverview.SpfRecord field to retrieve the SPF record for each domain.Displays the SPF record details, including the authorized email sender domains and IP addresses.Beneficiaries:IT Administrators: To verify and manage domain email authentication configurations.Security Teams: To ensure SPF records are implemented correctly and reduce vulnerabilities to spoofing.Compliance Officers: To verify adherence to email security best practices and organizational policies. EmailSecurityOverview.SpfRecord