Overview

Some of Liongard's Inspectors have the ability to pass data from a Metric, sourced from one Inspector, into the configuration of a second Inspector.

This reduces the need to manually update Inspector configurations.

For example, this functionality allows Liongard to automatically populate a list of email addresses from Microsoft 365, Google Workspace, etc. Inspectors for the Dark Web Monitoring Inspector. This will prevent the email list, used in the Dark Web Monitoring Inspector, from becoming stale.

The following Inspectors currently have this functionality:

• Dark Web Monitoring

The Liongard team is actively working to expand this capability for more Inspectors.

How does Dynamic Inspector Configuration work?

Once an Inspector has been configured using another Inspector's Metric(s). Each time the configured Inspector runs, it will pull the latest Metric value(s) from the other Inspector.

When configuring the Inspector, users will have the option to fail the configured Inspector if the Inspector, from which the Metric is derived, fails.

Dynamic Inspector Configuration: Dark Web Monitoring

• Adding a New System Inspector
• Editing an Active System Inspector

Adding a New System Inspector

Navigate to Admin > Inspectors > Search for the Dark Web Monitoring Inspector > Select Add System

Fill in the following information:

• Environment: Select the Environment this System should be associated to
• Friendly Name: Suggested "[Environment Name] Dark Web Monitoring"
• Agent: On-Demand
• Inspector Version: Latest
• Scheduling: The Inspector will default to run once a day at the time the Inspector is set up. Here you can adjust the schedule
• Email Addresses: You can add Email Addresses to the field in one of the following ways:
  • Dynamic Inspector Configuration (Recommended)
  • Typing in an Email Address and pressing Enter for each address
  • Pasting a comma-delimited list of email addresses and pressing Enter
  • Note:You can remove Email Addresses from the inspection by clicking the "X"

Dynamic Inspector Configuration

👍

Deploying Inspectors

Prior to using Dynamic Inspector Configuration, ensure that the Inspector(s) for which you would like to use Metrics are deployed and active. If Inspectors are not deployed, users will be unable to take advantage of their Metrics.

1. Select Add Metric Value

2. Select the Inspector and System for which you would like to use the Metric
3. Select the Metric you would like to use. Recommended Metrics are highlighted in green.

• Note: When selecting a Metric, ensure the output of the Metric matches the value needed to complete the field. For example, for Dark Web Monitoring, ensure you are selecting a Metric that outputs a list of email addresses. The Latest Metric Value will appear once a Metric is selected.

4. Because the Inspector being configured will be reliant on another Inspector's functionality, users must determine the behavior of the Inspector. The Inspector being configured will always use the latest Metric value by default.

• Users can choose to fail the Inspector being configured if the Metric value is so many days old, or users can choose to proceed with running the configured Inspector based on the latest available Metric value, which may be stale.
• There is a chance that the Metric value selected would return a null value. Users can choose to either fail the Inspector being configured, or they can choose to proceed with running the Inspector, omitting the results of the Metric selected.

5. Once all fields are completed, select Done. The results of the Metric will then display in the Inspector's configuration screen.

6. To add another Metric to the field, repeat steps 1-5.

Editing an Active System Inspector

To edit an active System Inspector's configurations, navigate to Admin > Inspectors > Select Dark Web Monitoring > Next to the System you would like to Edit, select the Actions button > Select Edit

Navigate to the System Settings section, and following the following Dynamic Inspector Configuration steps

FAQs/Quick Tips

• All results returned by the Metric will be included in the Inspector's configuration. There is no way to remove fields without creating a new Metric.