Get inspired and take wing with sample Metrics
Welcome to The Lagoon (a library of sorts), where you'll get a leg up (see what we did there?) on some custom metrics. So, you're either here to get some inspiration or learn the proper pronunciation of JMESpath. Either way, these sample metrics will hopefully get you started and truly experience the FULL value of our Liongard integration.
Tip Want more inspiration? Check out these Sample Use-Case Scenarios or the Liongard Library.
RoarPath Commands
Liongard JMESPath Extensions
There are several Liongard JMESPath extensions and functions to make JMESPath even more powerful and convenient. Functions including:
- Divide
- Subtract
- Percent_of
- Multiply
 |
Example
Calculating the extra cloud storage consumed with the Acronis inspector type.
Extra Cloud Storage Consumed = Total Storage - (Mailbox Storage + VM Storage)
divide(subtract(to_number(slice_string(to_string(Usages[].usages[?usage_name=='total_storage'].value), `2,-2`)),(subtract(to_number(slice_string(to_string(Usages[].usages[?usage_name=='mailbox_storage'].value), `2,-2`)),multiply(to_number(slice_string(to_string(Usages[].usages[?usage_name=='vm_storage'].value), `2,-2`)), to_number('-1'))))), to_number('1000'))
Sample Metrics
Want to share your own custom Metrics, or do you see something off? We'd love to hear from you! Don't hesitate to get in contact with us.
These are merely sample metrics and may not include examples from all inspector types available in Liongard. Also, these sample metrics are here for inspiration, as you may find your source of truth through different queries.
You have complex billing scenarios, so what's stopping you from automating billing reconciliation using custom metrics?
Note When creating custom metrics for Synthesize billing module, you must prefix the metric description with 'Gradient'.
Tip When creating customer metrics for the Microsoft 365 inspector type, product names and service plan identifiers for licensing can be found here.
| Child Inspector | Description | Query |
| Acronis | Count (GB) of Extra Cloud Storage Consumed |
divide(subtract(to_number(slice_string(to_string(Usages[].usages[?usage_name=='total_storage'].value), `2,-2`)),(subtract(to_number(slice_string(to_string(Usages[].usages[?usage_name=='mailbox_storage'].value), `2,-2`)),multiply(to_number(slice_string(to_string(Usages[].usages[?usage_name=='vm_storage'].value), `2,-2`)), to_number('-1'))))), to_number('1000'))
|
| Auvik | Count of Online Firewalls, L3 Switches, Switches, Routers |
Devices[?(attributes.deviceType == 'switch'||attributes.deviceType == 'l3Switch'||attributes.deviceType == 'router'||attributes.deviceType == 'firewall')&&attributes.onlineStatus=='online'] |length(@) |
| Auvik | Count of Online Firewalls |
Devices[?attributes.deviceType == 'firewall'&& attributes.onlineStatus =='online'] |length(@) |
| Auvik | Count of Online Routers |
Devices[?attributes.deviceType == 'router'&& attributes.onlineStatus =='online'] |length(@) |
| Auvik | Count of Online Switches |
Devices[?attributes.deviceType == 'switch'&& attributes.onlineStatus =='online'] |length(@) |
| Auvik | Count of Online L3 Switches |
Devices[?attributes.deviceType == 'l3Switch'&& attributes.onlineStatus =='online'] |length(@) |
| Auvik | Return count of '1' if contains managed network device for managed service |
Devices[?(attributes.deviceType == 'switch'||attributes.deviceType == 'l3Switch'||attributes.deviceType == 'router'||attributes.deviceType == 'firewall')&&attributes.onlineStatus=='online'] | to_number(`1`) |
| Active Directory | Count of Active Workstation |
Computers[?Type==`Workstation` && Status==`Active`] | length(@) |
| Active Directory | Count of Active Server |
Computers[?Type==`Server` && Status==`Active`] | length(@) |
| Active Directory | Count of Computers Whose Last Login is Within 30 Days |
Computers[? DaysSinceLastLogin < `31`] | length(@) |
| Active Directory | Count of Users Who Last Logged In Within 30 Days |
Users[? DaysSinceLastLogin < `31` && UserStatus == `Active` && DaysSinceLastLogin != `null` && Email !=`null` ] | length(@) |
| Azure Active Directory | Count of Users Assigned to Group |
Users[?contains(to_string(assignedGroups[]), 'Group')].displayName | length(@) |
| Azure Active Directory | Count of Users Assigned to Group(s) with Account Enabled (add the or-expression || to add multiple group names) |
Users[?contains(assignedGroups, `Insert Group Name`) && accountEnabled == `true` ].displayName | length(@) |
| Cisco Meraki | Count of Networks |
Networks[].name | length(@) |
| Cisco Umbrella | Count of Active Users |
users[?status==`Active`]|length(@) |
| Cisco Umbrella | Count of Devices |
roamingComputers[?lastSyncStatus != `Uninstalled`] | length(@) |
| Cisco Umbrella | Cisco Umbrella: Total Active Device Count Synced in the Last 30 Days |
roamingComputers[?lastSyncStatus != `Uninstalled` && daysSinceLastSync_r <= `30`].[name,daysSinceLastSync_r ,` days`]| length(@) |
| ConnectWise Automate | Count of ConnectWise Control |
UserClasses[?contains(WebExtensionClaims[].PermissionName, 'ConnectWise Control Access')].{"UserClass": Name}
|
| Continuum RMM | Count of RocketCyber agents installed on all Devices |
SoftwareInstalled.InstalledSoftware[?contains(Application, `RocketAgent`)] | length(@) |
| Continuum RMM | Count of Software Application Installed on all Devices |
SoftwareInstalled.InstalledSoftware[?contains(Application, 'Insert Application Name Here')] | length(@) |
| Continuum RMM | Count of Windows Servers |
AgentDetails.AgentDetails[?Type=='Server, Windows']| length(@) |
| Continuum RMM | Count of Windows Workstations |
AgentDetails.AgentDetails[?Type=='Desktop, Windows']| length(@) |
| Datto RMM | Count of Software Application Installed on all Devices |
DeviceSoftwareAudit[?contains(name, 'Insert Application Name Here')] | length(@) |
| Datto BCDR | Count of Protected Volumes |
sum(Assets[].protectedVolumesCount) |
| Datto BCDR | Count of Protected Assets |
length(Assets[]) |
| Datto BCDR | Count of Protected Assets with Protected Volumes |
length(Assets[?protectedVolumesCount > '0']) |
| Domotz | Count of Online Devices |
Devices[?status == `ONLINE`] | length(@) |
| DUO Security | Count of Active Users |
Users[?status == `active`] | length(@) |
| DUO Security | Count of Total Users |
SystemInfo.subtract(user_count,user_pending_deletion_count) |
| ESET Licensing | Count of Licenses |
Licenses[].quantity | sum(@) |
| Google Workspace | Count of Users |
Users[?archived == `true` || DaysSinceLastLogin_r <= '30'] | length(@) |
| Jumpcloud |
Count of Systems |
Systems[?active == `false`] | length(@) |
| Kaseya VSA | Count of Servers |
Agents[?contains(to_lower_case(OperatingSystem), `server`)].AgentName | length(@) |
| Kaseya VSA | Count of Workstations |
Assets[?DeviceType == 'Desktop/Laptop'] | length(@) |
| Kaseya VSA | Count of Workstations with Agents Last Checked In within the last 60 days |
Assets[?DeviceType == 'Desktop/Laptop'] && Agents[?LastCheckInTime <= '60'] | length(@) |
| Microsoft 365 |
Count of Consumed Licenses by Product Name |
sum(Licensing[?skuPartNumber == ``].consumedUnits) |
| Microsoft 365 | Count of Unused Licenses by Product Name |
Licensing[?ProductFriendlyName == `Microsoft 365 Business Premium`].UnconsumedUnits_r |
| Microsoft 365 | Count of Active Users with Consumed Licenses |
Users[?accountEnabled == `true` && Assigned_Products && (contains(Assigned_Products,`Microsoft 365 Business Premium`) || contains(Assigned_Products,`Microsoft 365 Business Standard`) || contains(Assigned_Products,`Exchange Online (Plan 2)`) || contains(Assigned_Products,`Microsoft 365 Business Basic`))].displayName | length(@) |
| Microsoft 365 | Count of Nonprofit Licenses (exceeding donated license count) |
Licensing[?ProductFriendlyName ==`Microsoft 365 Business Basic`] < '300' && Licensing[?ProductFriendlyName ==`Microsoft 365 Business Basic`].[subtract(consumedUnits, `300`)] | replace(to_string(@), 'false', '0') |
| N-able Backup | Count of Total Protected Office 365 User Accounts |
Devices[?Type == 'Office365']to_number(TotalProtectedUserAccounts) | sum(@) |
| N-able Backup | Count of Devices with Office 365 that are Completed |
Devices[?Type == `Office365` && TotalStatus == `Completed` || TotalStatus ==`CompletedWithErrors`] | length(@) |
| N-able | Count of Devices with Backup Manager that are Completed |
Devices[?Type == `BackupManager` && TotalStatus == `Completed` || TotalStatus ==`CompletedWithErrors`] | length(@) |
| N-able N-central | Count of Professional Licenses |
Devices[?Licensemode == `Professional`] | length(@) |
| N-able N-central | Count of Devices by Deviceclass and contains Longname |
to_number(Devices[] !=`null` && length(Devices[?contains(Deviceclass, `Workstation`) && !contains(to_lower_case(Longname), `insert name here`) || contains(Deviceclass, `Laptop`) && !contains(to_lower_case(Longname), `insert name here`)]) | replace(to_string(@), 'false', '0')) |
| N-able RMM | Count of Software Applications on all Workstations |
Workstations[].Software_r[?contains(name,'Insert Application Name')] | length(@) |
| N-able RMM | Count of Servers |
Servers | length(@) |
| N-able RMM | Count of Workstations |
Workstations | length(@) |
| Network Discovery | Count of Active Hosts |
Hosts[?Alive == `true`].[Hostname, `| `, Vendor, `| `, Ip] | length(@) |
| Ninja | Count of Devices |
to_number(Devices[] !=`null` && length(Devices[])| replace(to_string(@), 'false', '0')) |
| Roar | Count of Discovered Launchpoints (Inspectors) |
Launchpoints[? Status == `Discovered:Unconfigured` || Status == `Discovered:Configured`].Alias | length(@) |
| SentinelOne | Active Licenses |
SystemInfo.activeLicenses || to_number('0')
|
| SentinelOne | Count of Active Licenses of Singularity Control |
to_number(SystemInfo.sku == `Control` && ~.SystemInfo.totalLicenses | replace(to_string(@), to_string(`false`), to_string(`0`))) |
| SentinelOne | Count of Active Licenses of Singularity Complete |
to_number(SystemInfo.sku == `Complete` && ~.SystemInfo.totalLicenses | replace(to_string(@), to_string(`false`), to_string(`0`))) |
| Sophos Central | Count of Servers with Assigned Product(s) |
Endpoints[?type == `server`] || Endpoints[].assignedProducts[?code == 'coreAgent' && 'interceptX'] | length(@) |
| Sophos Central | Count of Workstations with Assigned Product(s) |
Endpoints[?type == `computer`] || Endpoints[].assignedProducts[?code == 'coreAgent' && 'interceptX' && 'mtr'] | length(@) |
| Syncro | Count of Active Portal Users |
PortalUsers[?disabled == `false`] | length(@) |
| Ubiquiti UniFi | Count of Ubiquiti UniFi Models |
to_number(Devices[] !=`null` && length(Devices[?contains(model, `US24PRO`)]) | replace(to_string(@), 'false', '0')) |
| Veeam Availability Console | Count of Rental Licenses for Veeam Backup and Replication (VBR) Microsoft Hyper-V. |
sum(LicensingBackupServerUsage[?type == `VBR_HyperV_VM`].rentalCount) |
| Veeam Availability Console | Count of Used Count for Veeam Backup and Replication (VBR) VMware vSphere and Hyper-V. |
sum(LicensingBackupServerUsage[?type == `VBR_vSphere_VM` || type == `VBR_HyperV_VM`].usedCount) |
| Veeam Availability Console | Count of Total Cloud Connect Licenses |
sum(LicensingCloudConnectUsage[?type == `CC_Server_Backup` || type == `CC_Workstation_Backup` || type == `CC_VM_Backup` ].rentalCount) |
| Veeam SPC | Total Count of Veeam Enterprise Plus Backup & Replication (dividing Points Per Unit |
LatestLicensingReports[].reportSummary.productsUsage[?licenseEdition ==`Enterprise Plus` && productType == `BackupAndReplication`]. divide (totalPoints, `11`) |
| Webroot | Count of Activated Users |
Users[?UserState == 'Activated'] | length(@) |
| Webroot | Count of Active Endpoints Seen in the Last 30 days |
Endpoints[?Deactivated == `false` && DaysSinceLastSeen <= `30`] | length(@) |