Overview

This document is meant to support you as you learn how to write Metrics. Listed below are several practice scenarios for you to practice writing Metrics. For more information on How to Create a Metric, please review our documentation.

Table of Contents

• Simple Query Practice
• Filter Practice
• Function Practice
• Filter and Function Practice

The Answer Key is located at the bottom of this page.

Simple Query Practice

• On-Demand Webinar: How to Write a Metric Workshop: Part 1
• Documentation: How to Write a Metric Workshop: Part 1

For each of the scenarios listed below, write a Metric query in Liongard's Metric Builder (Admin > Metrics > Add Metric). Check your answers using our Answer Key.

1. Get your Microsoft 365 current score from the Secure Scores Object.
2. Get your Microsoft 365 domains from the Overview Object in the System Info Object.
3. Get a list of the display names of your Microsoft 365 users in the Users Array.
4. Get a list of the sku IDs of your Microsoft 365 licenses in the Licensing Object.
5. Get a list of the mail nicknames of your active groups in the Groups Object.

Filter Practice

• On-Demand Webinar: How to Write a Metric Workshop: Part 2
• Documentation: How to Write a Metric Workshop: Part 2

For each of the scenarios listed below, write a Metric query in Liongard's Metric Builder (Admin > Metrics > Add Metric). Check your answers using our Answer Key.

1. Get a list of the display names of your active Microsoft 365 roles from the Roles Array.
2. Get a list of the control names of your control score whose score is less than 10 from the Control Scores Array in the Secure Scores Object.
3. Get a list of the service plan names of your Microsoft 365 licenses that apply to users from the Service Plans Array in the Licensing Array.
4. Get a list of the display names of your Microsoft 365 users whose account and on-premise sync is enabled from the Users Array.
5. Get a list of the display names of your Microsoft 365 groups whose mail or security is enabled from the Active Groups Array in the Groups Object.

Function Practice

• On-Demand Webinar: How to Write a Metric Workshop: Part 3
• Documentation: How to Write a Metric Workshop: Part 3

For each of the scenarios listed below, write a Metric query in Liongard's Metric Builder (Admin > Metrics > Add Metric). Check your answers using our Answer Key.

1. Get a count of your Microsoft 365 roles from the Roles Array.
2. Get a list of the display names of your Microsoft 365 users whose display name has "Admin" in it from the Users Array.
3. Get a comma-separated list of the IDs of your Microsoft 365 domains from the Domains Array.
4. Get a list of the display names of your Microsoft 365 active groups whose display name has "Admin" in it, and whose description contains "Admin" in it from the Active Groups Array in the Groups Object.
5. Get a count of your Microsoft 365 service principal names from the Service Principals Array.

Filter and Function Practice

For each of the scenarios listed below, write a Metric query in Liongard's Metric Builder (Admin > Metrics > Add Metric). Check your answers using our Answer Key.

1. Get a count of your Microsoft 365 licenses whose capability status is enabled in the Licensing Array.
2. Get a comma-separated list of the display names of your Microsoft 365 users who have not been active in the last 30 days from the Users Array.
3. Get a count of your Microsoft 365 active groups whose display name has "Admin" in it from the Active Groups Array in the Groups Object.
4. Get a comma-separated list of the display names of your Microsoft 365 service principals whose display name has "Microsoft" in it from the Service Principals Array.
5. Get a count of your Microsoft 365 users whose display name has "Admin" in it and is privileged from the Users Array.

Answer Key

Simple Query Practice

SecureScores.currentScore

SystemInfo.Overview.Domains

Users[].displayName

Licensing[].skuId

Groups.ActiveGroups[].mailNickname

Filter Practice

Roles[?Active == `true`].displayName
  or
Roles[?Active != `false`].displayName

SecureScores.controlScores[?score < `10`].controlName
  or
SecureScores.controlScores[?score <= `11`].controlName

Licensing[?appliesTo == `User`].servicePlans[].servicePlanName

Users[?accountEnabled == `true` && onPremisesSyncEnabled == `true`].displayName
  or
Users[?accountEnabled != `false` && onPremisesSyncEnabled != `false`].displayName

Groups.ActiveGroups[?mailEnabled == `true` || securityEnabled == `true`].displayName
  or
Groups.ActiveGroups[?mailEnabled != `false` || securityEnabled != `false`].displayName

Function Practice

length(Roles[])
or 
Roles[] | length(@)

Users[?contains(displayName, `Admin`)].displayName
  or
Users[?displayName | contains(@, `Admin`)].displayName

join(`, `, Domains[].id)
  or
Domains[].id | join(`, `, @)

Groups.ActiveGroups[? contains(displayName, `Admin`) && contains(description, `Admin`)].displayName

length(ServicePrincipals[].servicePrincipalNames[])
  or
ServicePrincipals[].servicePrincipalNames[] | length(@)

Filter and Function Practice

length(Licensing[?capabilityStatus == `Enabled`])
  or
Licensing[?capabilityStatus == `Enabled`] | length(@)

join(`, ` Users[?activeLast30Days == `false`].displayName)
  or
Users[?activeLast30Days == `false`].displayName | join(`, `, @)
  or
join(`, `   Users[?activeLast30Days != `true`].displayName)
  or
Users[?activeLast30Days != `true`].displayName | join(`, `, @)

length(Groups.ActiveGroups[?contains(displayName, `Admin`)])
  or
Groups.ActiveGroups[?displayName | contains(@, `Admin`)] | length(@)

join(`, `, ServicePrincipals[?contains(displayName, `Microsoft`)].displayName)
  or
ServicePrincipals[? displayName | contains(@ , `Microsoft`)].displayName | join(`, `, @)

length(Users[? contains(displayName, `Admin`) && Privileged == `No`])
  or
Users[?displayName | contains(@, `Admin`) && Privileged == `No`] | length(@)
  or
length(Users[? contains(displayName, `Admin`) && Privileged != `Yes`])
  or
Users[?displayName | contains(@, `Admin`) && Privileged != `Yes`] | length(@)