Liongard Sample Metrics

Get inspired and take wing – with sample custom Metrics

Welcome to The Lagoon (a library of sorts), where you'll get a leg up (see what we did there?) on some custom metrics. So, you're either here to get some inspiration or learn the proper pronunciation of JMESpath. Either way, these sample metrics will hopefully get you started and truly experience the FULL value of our Liongard integration.

Tip Want more inspiration? Check out these Sample Use-Case Scenarios or the Liongard Library.

RoarPath Commands

Liongard JMESPath Extensions

There are several Liongard JMESPath extensions and functions to make JMESPath even more powerful and convenient. Functions including:

  • Divide
  • Subtract
  • Percent_of
  • Multiply
   

Example

Calculating the extra cloud storage consumed with the Acronis inspector type.

Extra Cloud Storage Consumed = Total Storage - (Mailbox Storage + VM Storage)
divide(subtract(to_number(slice_string(to_string(Usages[].usages[?usage_name=='total_storage'].value), `2,-2`)),(subtract(to_number(slice_string(to_string(Usages[].usages[?usage_name=='mailbox_storage'].value), `2,-2`)),multiply(to_number(slice_string(to_string(Usages[].usages[?usage_name=='vm_storage'].value), `2,-2`)), to_number('-1'))))), to_number('1000')) 

Sample Metrics

Want to share your own custom Metrics, or do you see something off? We'd love to hear from you! Don't hesitate to get in contact with us.

These are merely sample metrics, and may not include examples from all inspector types available in Liongard. Also, these sample metrics are here for inspiration, as you may find your source of truth through different queries.

You have complex billing scenarios, so what's stopping you from automating billing reconciliation using custom metrics?

Note When creating custom metrics for Synthesize billing module you must prefix the metric description with 'Gradient'.

Tip When creating customer metrics for the Microsoft 365 inspector type, product names and service plan identifiers for licensing can be found here.

Child Inspector Description  Query
Acronis Count (GB) of Extra Cloud Storage Consumed
divide(subtract(to_number(slice_string(to_string(Usages[].usages[?usage_name=='total_storage'].value), `2,-2`)),(subtract(to_number(slice_string(to_string(Usages[].usages[?usage_name=='mailbox_storage'].value), `2,-2`)),multiply(to_number(slice_string(to_string(Usages[].usages[?usage_name=='vm_storage'].value), `2,-2`)), to_number('-1'))))), to_number('1000')) 
Auvik Count of Online Firewalls, L3 Switches, Switches, Routers
Devices[?(attributes.deviceType == 'switch'||attributes.deviceType == 'l3Switch'||attributes.deviceType == 'router'||attributes.deviceType == 'firewall')&&attributes.onlineStatus=='online'] |length(@)
Auvik Count of Online Firewalls
Devices[?attributes.deviceType == 'firewall'&& attributes.onlineStatus =='online'] |length(@)
Auvik Count of Online Routers
Devices[?attributes.deviceType == 'router'&& attributes.onlineStatus =='online'] |length(@)
Auvik Count of Online Switches
Devices[?attributes.deviceType == 'switch'&& attributes.onlineStatus =='online'] |length(@)
Auvik Count of Online L3 Switches
Devices[?attributes.deviceType == 'l3Switch'&& attributes.onlineStatus =='online'] |length(@)
Auvik Return count of '1' if contains managed network device for managed service
Devices[?(attributes.deviceType == 'switch'||attributes.deviceType == 'l3Switch'||attributes.deviceType == 'router'||attributes.deviceType == 'firewall')&&attributes.onlineStatus=='online'] | to_number(`1`)
Active Directory Count of Active Workstation
Computers[?Type==`Workstation` && Status==`Active`] | length(@)
Active Directory Count of Active Server 
Computers[?Type==`Server` && Status==`Active`] | length(@)
Active Directory Count of Computers Whose Last Login is Within 30 Days
Computers[? DaysSinceLastLogin < `31`] | length(@)
Active Directory Count of Users Who Last Logged In Within 30 Days
Users[? DaysSinceLastLogin < `31` && UserStatus == `Active` && DaysSinceLastLogin != `null` && Email !=`null` ] | length(@)
Azure Active Directory Count of Users Assigned to Group
Users[?contains(to_string(assignedGroups[]), 'Group')].displayName | length(@)
Azure Active Directory Count of Users Assigned to Group(s) with Account Enabled (add the or-expression || to add multiple group names)
Users[?contains(assignedGroups, `Insert Group Name`) && accountEnabled == `true` ].displayName  | length(@)
Cisco Meraki  Count of Networks
Networks[].name | length(@)
Cisco Umbrella Count of Active Users
users[?status==`Active`]|length(@)
Cisco Umbrella Count of Devices
roamingComputers[?lastSyncStatus != `Uninstalled`] | length(@)
Cisco Umbrella Cisco Umbrella: Total Active Device Count Synced in the Last 30 Days
roamingComputers[?lastSyncStatus != `Uninstalled` && daysSinceLastSync_r <= `30`].[name,daysSinceLastSync_r ,` days`]| length(@)
ConnectWise Automate Count of ConnectWise Control 
UserClasses[?contains(WebExtensionClaims[].PermissionName, 'ConnectWise Control Access')].{"UserClass": Name}
Continuum RMM Count of RocketCyber agents installed on all Devices
SoftwareInstalled.InstalledSoftware[?contains(Application, `RocketAgent`)] | length(@)
Continuum RMM Count of Software Application Installed on all Devices
SoftwareInstalled.InstalledSoftware[?contains(Application, 'Insert Application Name Here')] | length(@)
Continuum RMM Count of Windows Servers
AgentDetails.AgentDetails[?Type=='Server, Windows']| length(@)
Continuum RMM Count of Windows Workstations
AgentDetails.AgentDetails[?Type=='Desktop, Windows']| length(@)
Datto RMM Count of Software Application Installed on all Devices
DeviceSoftwareAudit[?contains(name, 'Insert Application Name Here')] | length(@)
Datto BCDR Count of Protected Volumes
sum(Assets[].protectedVolumesCount)
Datto BCDR Count of Protected Assets
length(Assets[])
Datto BCDR Count of Protected Assets with Protected Volumes
length(Assets[?protectedVolumesCount  > '0'])
Domotz Count of Online Devices
Devices[?status == `ONLINE`] | length(@)
DUO Security Count of Active Users
Users[?status == `active`] | length(@)
DUO Security Count of Total Users
SystemInfo.subtract(user_count,user_pending_deletion_count)
ESET Licensing Count of Licenses
Licenses[].quantity | sum(@)
Google Workspace Count of Users
Users[?archived == `true` || DaysSinceLastLogin_r <= '30'] | length(@)
Jumpcloud

Count of Systems

Systems[?active == `false`] | length(@)
Kaseya VSA Count of Servers
Agents[?contains(to_lower_case(OperatingSystem), `server`)].AgentName | length(@)
Kaseya VSA Count of Workstations
Assets[?DeviceType == 'Desktop/Laptop'] | length(@)
Kaseya VSA Count of Workstations with Agents Last Checked In within the last 60 days
Assets[?DeviceType == 'Desktop/Laptop'] && Agents[?LastCheckInTime <= '60'] | length(@)
Microsoft 365

Count of Consumed Licenses by Product Name

sum(Licensing[?skuPartNumber == ``].consumedUnits)
Microsoft 365 Count of Unused Licenses by Product Name
Licensing[?ProductFriendlyName == `Microsoft 365 Business Premium`].UnconsumedUnits_r
Microsoft 365 Count of Active Users with Consumed Licenses
Users[?accountEnabled == `true` && Assigned_Products && (contains(Assigned_Products,`Microsoft 365 Business Premium`) || contains(Assigned_Products,`Microsoft 365 Business Standard`) || contains(Assigned_Products,`Exchange Online (Plan 2)`) || contains(Assigned_Products,`Microsoft 365 Business Basic`))].displayName | length(@)
Microsoft 365 Count of Nonprofit Licenses (exceeding donated license count)
Licensing[?ProductFriendlyName ==`Microsoft 365 Business Basic`] < '300' && Licensing[?ProductFriendlyName ==`Microsoft 365 Business Basic`].[subtract(consumedUnits, `300`)] | replace(to_string(@), 'false', '0') 
N-able Backup Count of Total Protected Office 365 User Accounts
Devices[?Type == 'Office365']to_number(TotalProtectedUserAccounts) | sum(@)
N-able Backup Count of Devices with Office 365 that are Completed
Devices[?Type == `Office365` && TotalStatus == `Completed` || TotalStatus ==`CompletedWithErrors`] | length(@)
N-able Count of Devices with Backup Manager that are Completed
Devices[?Type == `BackupManager` && TotalStatus == `Completed` || TotalStatus ==`CompletedWithErrors`] | length(@)
N-able N-central Count of Professional Licenses
Devices[?Licensemode == `Professional`] | length(@)
N-able N-central Count of Devices by Deviceclass and contains Longname
to_number(Devices[] !=`null` && length(Devices[?contains(Deviceclass, `Workstation`) && !contains(to_lower_case(Longname), `insert name here`) || contains(Deviceclass, `Laptop`) && !contains(to_lower_case(Longname), `insert name here`)]) | replace(to_string(@), 'false', '0'))
N-able RMM Count of Software Applications on all Workstations
Workstations[].Software_r[?contains(name,'Insert Application Name')] | length(@)
N-able RMM Count of Servers
Servers | length(@)
N-able RMM Count of Workstations
Workstations | length(@)
Network Discovery Count of Active Hosts
Hosts[?Alive == `true`].[Hostname, `| `, Vendor, `| `, Ip] | length(@)
Ninja Count of Devices
to_number(Devices[] !=`null` && length(Devices[])| replace(to_string(@), 'false', '0'))
Roar Count of Discovered Launchpoints (Inspectors)
Launchpoints[? Status == `Discovered:Unconfigured` || Status == `Discovered:Configured`].Alias | length(@)
SentinelOne Active Licenses
SystemInfo.activeLicenses || to_number('0')
SentinelOne Count of  Active Licenses of Singularity Control
to_number(SystemInfo.sku == `Control` && ~.SystemInfo.totalLicenses | replace(to_string(@), to_string(`false`), to_string(`0`)))
SentinelOne Count of  Active Licenses of Singularity Complete
to_number(SystemInfo.sku == `Complete` && ~.SystemInfo.totalLicenses | replace(to_string(@), to_string(`false`), to_string(`0`)))
Sophos Central Count of Servers with Assigned Product(s)
Endpoints[?type == `server`] ||  Endpoints[].assignedProducts[?code == 'coreAgent' && 'interceptX']  | length(@)
Sophos Central Count of Workstations with Assigned Product(s)
Endpoints[?type == `computer`] ||  Endpoints[].assignedProducts[?code == 'coreAgent' && 'interceptX' && 'mtr']  | length(@)
Syncro Count of Active Portal Users
PortalUsers[?disabled == `false`] | length(@)
Ubiquiti UniFi Count of Ubiquiti UniFi Models
to_number(Devices[] !=`null` && length(Devices[?contains(model, `US24PRO`)]) |  replace(to_string(@), 'false', '0'))
Veeam Availability Console Count of Rental Licenses for Veeam Backup and Replication (VBR) Microsoft Hyper-V.
sum(LicensingBackupServerUsage[?type == `VBR_HyperV_VM`].rentalCount)
Veeam Availability Console Count of Used Count for Veeam Backup and Replication (VBR) VMware vSphere and Hyper-V.
sum(LicensingBackupServerUsage[?type == `VBR_vSphere_VM` || type == `VBR_HyperV_VM`].usedCount)
Veeam Availability Console Count of Total Cloud Connect Licenses
sum(LicensingCloudConnectUsage[?type == `CC_Server_Backup` || type == `CC_Workstation_Backup` || type == `CC_VM_Backup` ].rentalCount)
Veeam SPC Total Count of Veeam Enterprise Plus Backup & Replication (dividing Points Per Unit 
LatestLicensingReports[].reportSummary.productsUsage[?licenseEdition ==`Enterprise Plus` &&  productType == `BackupAndReplication`]. divide (totalPoints, `11`)
Webroot Count of Activated Users
Users[?UserState == 'Activated'] | length(@)
Webroot Count of Active Endpoints Seen in the Last 30 days
Endpoints[?Deactivated == `false` && DaysSinceLastSeen <= `30`] | length(@)