Overview

Liongard Roar Assistant: AI-Generated Reports

Roar Assistant can now build finished, customer-ready reports from your live Liongard data. Choose a format and a report template, add one or more Environments, and Roar Assistant writes the report and hands you a file you can download and share — a CMMC or HIPAA readiness report, a cyber insurance questionnaire, a quarterly business review, an assessment, or a data-rich inventory. Turning inspection data into a QBR or readiness report now takes minutes instead of an afternoon of exporting data and writing the story yourself.

What's New

• A new Designer mode in the Roar Assistant composer, alongside Chat, with a Format picker and a Template picker
• A searchable library of curated report recipes, including CMMC Readiness, HIPAA Readiness, FTC Safeguards Rule Readiness, Cyber Insurance Readiness, Domain Assessment, and Identity MFA Gap Report
• No template required — add the Environment with + or an @ mention and describe the report you want in plain language
• Six output formats: PDF, Word, Excel, PowerPoint, HTML, and Markdown
• A new Liongard report design for HTML, PDF, and PowerPoint reports, with a cover page and numbered sections
• Revisions in the same conversation — change tone, length, or emphasis, add a section that needs more data, refresh the data to today, or ask for the same report in another format. Every version stays downloadable.
• Multi-environment reports that cover up to 10 Environments in one Excel workbook, with a summary sheet and every row labeled by Environment
• Every report is saved automatically as a Note on the Environment, and each report card shows the AI Insights it used

What You Need to Know

Report generation draws from the same AI Insights balance you already use for chat, and runs on the model selected in Roar Assistant or Auto. Multi-environment reports export as Excel only, can't be revised in the conversation, and can only be viewed by users with access to every Environment in the run. Readiness reports are AI-written starting points, not compliance certifications, so review them before sharing them with Customers. Reports use the Liongard design in this release; MSP and Customer branding isn't available yet, and reports are downloaded to view. Report mode, which writes up your existing Reporting templates with AI, will follow in a later release.

To learn more about this feature, please review our documentation.

Microsoft 365 Inspector Enhancement: Data Exfiltration Detection Metrics and Alerts

Data exfiltration from Microsoft 365 often starts with a weakened control or a quietly added application: legacy protocols that bypass MFA, audit logging switched off, or a new third-party app granted broad permissions. The Microsoft 365 Inspector now ships five new Global default metrics and matching Actionable Alerts that surface these risks in every tenant, so you no longer need to hand-build JMESPath metrics and alerts per tenant to watch for them.

What's New

• Users with Legacy Authentication Not Blocked Count — users who can still sign in over IMAP, POP3, or SMTP, which bypass MFA. Any non-zero value is exposure.
• Mailbox Auditing Score — 100 when mailbox audit logging is enabled tenant-wide, and 0 when mailbox access isn't being logged
• Audit Log Search Score — 100 when unified audit log search is enabled, and 0 when the logging that would reveal exfiltration is off
• Enterprise Applications List — the Enterprise Applications consented into the tenant, with change detection so a newly added app is flagged
• Enterprise App Consent Grants (Admin Consent) — per-app, per-scope admin consent grants, so an existing app that is later granted a new scope is also caught
• Five new default alert rules: Legacy Authentication Not Blocked, Mailbox Auditing Disabled, Audit Log Search Disabled, New Enterprise Application Added, and New Enterprise App Consent Grant

What You Need to Know

No new permissions are required — the metrics read data the Microsoft 365 Inspector already collects. To receive the alerts, enable the rules in the active template for the Environments where you want them. Alerts generate the same way existing Microsoft 365 alerts do, such as Exposure to Suspicious Sign-Ins.

Asset Inventory: OpenAI Platform Members

As your Customers adopt AI platforms, you need to know who has access to them. OpenAI Platform organization members now appear in Asset Inventory > Identities, so you can review and audit a Customer's OpenAI footprint in the same place as every other identity you manage.

What's New

• OpenAI organization members appear as Identity records with their email, role, and added date
• Records stay current with each inspection

What You Need to Know

No new credentials are required. The OpenAI Platform Organization child launchpoint must be assigned to an Environment and activated, with a successful inspection. If no OpenAI identities appear, assign and activate the child launchpoint, then re-run the inspection. OpenAI service accounts, API keys, and pending invites aren't included in this release.

Cloudflare Inspector Enhancement: Zero Trust, WAF Rulesets, and Per-Zone Environment Mapping

The Cloudflare Inspector now covers the Cloudflare configuration MSPs standardize and drift on, and restores WAF data that Cloudflare's API retirements had removed from inspections. MSPs whose single Cloudflare account holds every client's zones can now map each zone, with its full Cloudflare configuration, to the right Customer Environment.

What's New

• WAF custom rules, managed WAF rules, and rate limiting rules, collected through Cloudflare's current Rulesets API
• Zero Trust coverage: Access applications, policies, and service tokens; Gateway rules and lists; Cloudflare Tunnels; and device posture
• Load Balancing, DNSSEC, Turnstile widgets, and Workers scripts and routes
• New alert rules for WAF custom rule and Gateway rule changes, Access policy changes, Access service tokens expiring within 30 days, Tunnel ingress changes, Tunnels down, and DNSSEC changes
• Opt-in per-zone child inspectors, so each zone can be mapped to its own Customer Environment. Account-level child inspectors remain the default.

What You Need to Know

Existing launchpoints keep working with no setup changes. The first inspection after this release shows a larger-than-usual timeline change as the new data appears. The minimum TLS version metrics and alert now read each zone's actual minimum TLS version, so they may report values for the first time and the rule may fire on its first run. Zone settings are now collected per setting, so the Settings view lists a focused set of about 10 settings. The parent Overview now correctly shows whether two-factor authentication is enforced on the account. The Page Rules view will empty over time as Cloudflare migrates zones off Page Rules.

To learn more about this inspector, please review our documentation.

Proxmox VE Inspector (Beta)

Proxmox VE is an open-source virtualization platform for KVM virtual machines and LXC containers, and a common VMware ESXi replacement for MSP Customers. You can now use the Proxmox VE Inspector (Beta) to document a Proxmox cluster or standalone host with a read-only API token — the cluster, its nodes, and every virtual machine and container — with each Proxmox node discovered as its own Child Inspector, and no software installed on the hypervisor.

What you can monitor

• Cluster health, including quorum, node membership, and offline nodes
• Every virtual machine and LXC container with its host, status, sizing, snapshots, and HA state
• Backup coverage, including guests in no backup job and backup task results from the last 7 days
• Storage capacity, high availability, replication jobs, and resource pools
• Users, API tokens, Administrator role assignments, and second-factor enrollment
• Per node: Proxmox VE and kernel version, end-of-life status, subscription, update repositories, certificates, physical disk health, and core service state

Benefits

• Keep the visibility you had on VMware ESXi after migrating a Customer to Proxmox VE.
• Prove backup coverage by finding guests outside every backup job and clusters with no successful backup in 7 days.
• Know as soon as a node goes offline or a cluster loses quorum, and catch storage running low before it fills.
• Stay ahead of lifecycle risk from end-of-life releases, lapsing subscriptions, and expiring certificates.

Beta: This inspector is currently available as a Beta feature. Functionality may evolve as we continue to enhance the integration based on partner feedback.

Please review our documentation to learn more about this inspector.

RingCentral Inspector (Beta)

RingCentral is a cloud business phone system (RingEX) with calling, SMS, video meetings, and contact center built in. You can now use the RingCentral Inspector (Beta) to connect to a Customer's RingCentral account through the read-only RingCentral Platform API and bring the phone system's users, admin access, phone numbers, call queues, sites, and desk phones into Liongard — without logging in to the RingCentral Admin Portal.

What you can monitor

• Account status, service plan, billing plan, and enabled features
• Every extension, with status, department, site, admin permission, and assigned roles
• Company phone numbers, their status, and the extension each number rings
• Call queues and their members
• Desk phones, with model, serial number, online status, assigned user, and E911 emergency address status
• Multi-Site sites and IVR menus

Benefits

• Get alerted when the number of admins or Super Admins changes, and review exactly who holds those rights.
• Find desk phones with an invalid E911 emergency address, a compliance exposure under US Kari's Law and RAY BAUM's Act.
• Spot enabled call queues with no members, where Customer calls go unanswered.
• Verify offboarding by confirming departed users' extensions and numbers are released.

The inspector supports both the RingCentral platform and the platform used by AT&T Office@Hand and Verizon. RingCentral doesn't offer a partner-level API, so you add one launchpoint per Customer account.

Beta: This inspector is currently available as a Beta feature. Functionality may evolve as we continue to enhance the integration based on partner feedback.

Please review our documentation to learn more about this inspector.

HPE Aruba Central Inspector (Beta)

HPE Aruba Networking Central is HPE's cloud platform for managing access points, switches, and gateways, run by MSPs from an HPE GreenLake Managed Service Provider workspace. You can now use the HPE Aruba Central Inspector (Beta) to connect once to your MSP workspace and automatically discover every tenant workspace that has Aruba Central, so each Customer's network gets its own Liongard Environment — with one credential and no per-Customer setup.

What you can monitor

• Every tenant workspace, including whether Aruba Central is provisioned, site count, device health, and alert counts
• Each Customer's access points, switches, and gateways, with model, serial, IP, status, firmware, and site
• Sites and their health
• Active alerts by severity and status
• Firmware compliance against Aruba Central's recommended version
• Subscriptions expiring in the next 12 months, and the last 7 days of audit events

Benefits

• Know when a Customer's devices go offline or critical alerts become active.
• Find devices that aren't on Aruba Central's recommended firmware.
• Catch Aruba subscriptions expiring within 90 days, at the MSP level and per Customer, before renewals slip.
• Spot tenant workspaces that don't have Aruba Central provisioned yet.

Beta: This inspector is currently available as a Beta feature. Functionality may evolve as we continue to enhance the integration based on partner feedback.

Please review our documentation to learn more about this inspector.

ScalePad Lifecycle Manager X Inspector (Beta)

ScalePad Lifecycle Manager X is the platform MSPs use to track hardware inventory, warranty and replacement timelines, service contracts, and vCIO planning across their Customer base. You can now use the ScalePad Lifecycle Manager X Inspector (Beta) to connect to your ScalePad tenant with a single API key, discover every managed Customer, and bring each Customer's hardware fleet, warranty status, contracts, SaaS assets, and lifecycle insights into Liongard.

What you can monitor

• Every managed Customer, with tenant roll-ups of clients, hardware assets, contacts, and integrations
• Hardware inventory per Customer, including type, manufacturer, model, serial number, and operating system
• Warranty expiry, manufacturer end-of-life, warranty-expired, and replacement-due hardware
• Service contracts, with type and status
• ScalePad lifecycle insights, with risk level and affected asset count
• SaaS assets tracked in ScalePad

Benefits

• Get alerted when a Customer's warranty-expired or replacement-due hardware count rises, before hardware fails without coverage.
• Catch a drop in active contracts before the billing cycle does.
• Bring High-risk lifecycle insights into the Liongard timeline, so business reviews rest on objective data.
• Correlate hardware lifecycle risk with each Customer's security posture in one place.

Warranty records, lifecycle insights, and the warranty-expired and replacement-due counts require a ScalePad Lifecycle Manager subscription.

Beta: This inspector is currently available as a Beta feature. Functionality may evolve as we continue to enhance the integration based on partner feedback.

Please review our documentation to learn more about this inspector.

Microsoft Intune Inspector (Beta)

Microsoft Intune is Microsoft's cloud-based unified endpoint management platform for Windows, iOS/iPadOS, Android, and macOS devices. You can now use the Microsoft Intune Inspector (Beta) to discover every Customer tenant reachable through your active GDAP relationships and track each tenant's device compliance, configuration, apps, Autopilot, and Conditional Access posture — without opening the Intune admin center for every Customer.

What you can monitor

• Managed device inventory, with OS, ownership, compliance state, encryption, and last sync
• Non-compliant devices, in a filtered view for fast triage
• Compliance policies and configuration profiles, including Settings Catalog
• The managed app catalog and App Protection Policies
• Windows Autopilot deployment profiles and registered devices
• Conditional Access policies, with state and grant controls
• Intune license status

Benefits

• Get alerted when compliant devices drop, non-compliant devices rise, or encrypted device counts fall.
• Detect compliance policy and configuration profile changes made outside your standard build.
• Know when a Conditional Access policy is disabled, an early Customer risk indicator.
• Catch an Intune license lapse as a tracked change, not a surprise.

The inspector uses the same Microsoft partner sign-in as the Microsoft 365 Inspector. If you've already connected Microsoft 365, no new admin consent step is required.

Beta: This inspector is currently available as a Beta feature. Functionality may evolve as we continue to enhance the integration based on partner feedback.

Please review our documentation to learn more about this inspector.

WatchGuard Cloud Inspector (Labs)

WatchGuard Cloud is WatchGuard's management platform for Firebox firewalls, Wi-Fi access points, WatchGuard Endpoint Security, AuthPoint, and FireCloud. You can now use the WatchGuard Cloud Inspector (Labs) to connect to your WatchGuard Cloud Service Provider account, discover every Customer account you manage, and bring each Customer's Fireboxes, access points, endpoint protection, licences, and operators into Liongard — from a single Service Provider credential.

What you can monitor

• Every Customer account you manage, with licence allocations and expiration dates
• Fireboxes, FireClusters, and access points, with model, serial number, Fireware version, and connection state
• Firebox and access point licence expirations
• WatchGuard Endpoint Security devices, with protection, isolation, and licence status
• WatchGuard Cloud operators and their MFA state, for your account and every Customer account

Benefits

• Know when a Customer's Firebox goes offline, its firmware changes, or a licence is about to expire.
• Find endpoints that are unprotected, isolated, unlicensed, or haven't checked in for a week.
• Audit WatchGuard Cloud operators without MFA across every Customer.

This inspector is separate from the WatchGuard Inspector, which connects to a single Firebox over SSH. Use both together: WatchGuard Cloud for fleet-wide inventory, licensing, and endpoint protection, and the WatchGuard Inspector for deep per-Firebox configuration.

Labs: A Labs Inspector is read-only and low risk. It has passed tests using simulated data but may not have been fully tested against production instances. Data presentation and metrics may still need refinement, such as displaying a UUID instead of a name. Labs Inspectors are subject to breaking changes and should be used at your own risk.

Please review our documentation to learn more about this inspector.

---

Minor Updates and Bug Fixes

Platform and Gen AI Minor Updates and Bug Fixes

• Platform data tables now use infinite scroll, so large tables load and scroll faster.
• Pages now keep showing cached data while reference data refreshes, instead of a loading spinner, and no longer re-request reference data that's already loaded.
• Liongard's backend AI processing now uses Claude Haiku 5.5 and Claude Sonnet 5.5 in place of Claude Haiku 4.5 and Claude Sonnet 5.
• Added minimum agent version messaging to the agent self-update settings and the Failed Updates tile.
• HaloPSA is now a device source in Asset Inventory, with additional HaloPSA data and a place in the Devices source-priority list.
• Fixed an issue where the AI Insights unlimited overage setting wasn't honored, blocking Roar Assistant chat with a quota exceeded message.
• Fixed an issue where confirming a Roar Assistant request could return a cached answer from an earlier question.
• Improved Roar Assistant answers to device coverage-gap questions.
• Fixed an issue where the embedded assistant's Summarize this ticket returned a summary of all open tickets instead of the ticket on screen.
• Fixed an issue where the Metric Builder AI Assistant generated ConnectWise Asio queries with datapoints that don't exist.
• Fixed an issue where bulk enabling or disabling AI usage didn't update the Environments table.
• Fixed an issue where the AI Preferences export left out MCP credential Environment details, and where MCP token access didn't update automatically for new clients.
• Fixed an issue where manually created devices in Asset Inventory had no visible manually added indicator.
• Fixed an issue where Asset Inventory write actions were visible to users without the Edit Environment permission.
• Fixed an issue where a deleted domain wasn't reactivated after a launchpoint updated its Last Seen date.
• Fixed the Actions column position in the default Identities & Accounts quick views.
• Fixed an issue where a newly added manual device didn't appear in Network Topology Explorer.
• Fixed an issue where change detection reported unchanged items as removed and re-added when a metric's output order changed.
• Fixed an issue where Actionable Alert formatting wasn't sent to Autotask when an alert was generated.
• Fixed an issue where Select All in the Actionable Alert silence window selected only the first 25 systems.
• Fixed an issue where MFA data wasn't reflected on the Cyber Risk Dashboard, and fixed Cynet EPS EDR detection on the Cyber Risk Dashboard.
• Fixed an issue where report data didn't load when multiple Environments were selected, and where one-time reports stayed on Fetching report data for up to 5 minutes.
• Fixed the Edit templates window layout for Environments with long or special-character names.
• Fixed an issue where clicking the agent count on the Environments page applied the wrong filter on the Agents page, and where agents couldn't be reassigned from the Environment > Agents page.
• Fixed an error page when deleting agents.
• Fixed an issue where an Environment couldn't be re-created because of an incorrect pending deletion status.
• Fixed an invalid environment ID error when adding or modifying Environment Groups, and an issue where the Manager role couldn't set an Environment Group on the Import Companies screen.
• Fixed an issue where Liongard Environment names didn't update when a ConnectWise company was renamed with Enable Environment Name Sync turned on.
• Fixed an issue where deleting a synced record reported success when the vendor archive failed.
• Fixed pagination and the close button in the webhook delivery log table.
• Fixed an issue where updating an older metric failed.
• Fixed an issue where POST /metrics created a metric even when it returned a 400 error for an invalid fields parameter.
• Fixed a 500 error when filtering on nested text fields in the v1 Timeline API, and a 500 error from POST /api/v2/timelines/query.
• Fixed blank view tabs on 27 inspectors.
• Fixed inspector timeouts.
• Fixed an issue where Roarbot added comments on every run even when metric output hadn't changed.

Integration and Inspector Minor Updates and Bug Fixes

• Anthropic
  • Fixed an issue where Enterprise Analytics user activity data was collected but not included in the results. User activity for Claude Enterprise users, such as conversations, messages, projects, artifacts, code sessions, and web searches, now appears under System Details > Users.
• Arctic Wolf
  • Fixed child inspectors failing with an Organization ID error.
• BitLyft
  • The inspector now collects dashboard overview data.
• Cisco IOS
  • Fixed VLAN name parsing.
• Cloudflare
  • Fixed an issue where a parent inspection succeeded with an empty result when the API token could see no accounts.
• ConnectWise Asio
  • Added device Last Online and availability data.
• ConnectWise Manage
  • The inspector now collects additional data.
  • Fixed an issue where configurations were missing from inspection data.
• ESET
  • The inspector now collects additional data.
• Fortinet FortiGate
  • Fixed an issue where SSL VPN was reported as enabled on devices that don't support SSL VPN.
• Fortinet FortiManager
  • Fixed an issue where a device's ADOM wasn't recorded.
• Google Workspace
  • Fixed the Privileges Added, Removed, or Modified Actionable Alert.
• HaloPSA
  • The inspector now collects additional data.
• Huntress
  • Fixed an issue where previously activated child inspectors were rediscovered as duplicate systems.
• ImmyBot
  • Fixed an issue where child computers weren't scoped to the Customer and the MSP tenant was discovered as a Customer.
  • Fixed blank columns in the child inspector views.
• Internet Domain
  • The inspector now collects additional data.
• KnowBe4
  • Moved the inspector to cursor-based pagination ahead of KnowBe4's November 15, 2026 API change, and the inspector now collects additional data.
• macOS
  • Fixed an issue where launchpoint changes couldn't be saved because the inspector template wasn't found.
• Microsoft 365
  • Fixed an issue where last sign-in data wasn't displayed.
  • Fixed an issue where scheduled inspections timed out.
  • Fixed HTTP 403 errors caused by a conflict between two Liongard inspectors.
• Network Discovery Inspector
  • Fixed an issue where Default Inspector Settings failed to load and save.
  • The inspector now collects additional data.
• Qualys
  • Fixed a 403 error on the appliance endpoint.
• SentinelOne
  • Fixed a 500 error when saving parent inspector changes.
• SonicWall
  • Fixed bearer token authentication for SonicOS 7, and the inspector now collects additional data.
• SonicWall NSM
  • Fixed authentication failures, including login rejecting the account email.
  • Licenses and support past their expiry date are now counted as expired, and the Licenses view shows the expired state.
• Synology NAS
  • Fixed a 500 error when saving a launchpoint on its first edit.
• UniFi Cloud
  • Fixed inspectors stuck in Scheduled, and an HTTP 500 error when collecting devices for non-default sites.
• Veeam Availability Console
  • The Veeam Availability Console Inspector is now deprecated.
• Webroot
  • The inspector now collects additional data.
• Windows Server
  • Fixed an issue where the System Details > Security > Password Policy table was empty even though the data was collected.
• Windows Workstation
  • The inspector now collects additional data.
  • Fixed an issue where the inspector executable triggered LSASS security alerts.
  • Fixed an issue where Windows Workstation Inspectors didn't run after offline agents reconnected.
  • Fixed a 400 server error in Automated Documentation for ConnectWise.

Visual Insights Minor Updates and Bug Fixes

Features

• Reports
  • Design reusable, multi-page Report Blueprints on a 12-column grid with headers, text, metrics, tables, charts, and images, and export them as PDFs.
  • Choose Letter, Legal, Tabloid, or A4, set portrait or landscape per page, and preview the layout live while editing.
  • Save Snapshot stores a point-in-time Report PDF in Report History, where it can be downloaded, emailed, or deleted. Preview Report checks the PDF without adding it to history.
  • Report Variables, with defaults and date presets such as start of last month, let one blueprint produce a report per company or per period.
  • House Styles keep fonts, colors, and table and chart styling consistent across blueprints, with saved revisions.
  • Roar Designer can build a report from a plain-language description and revise any page or element with you. Long tables continue onto extra PDF pages instead of being cut off.
• Workflows
  • VI admins can build automations on a visual canvas that run on a schedule or when Dataset rows newly match a condition, with conditions, report generation, email delivery, and AI steps — for example, to email reports on a schedule.
  • Test any workflow before turning it on, and review every run on a timeline that shows the path it took.
• Dashboards and data
  • Dashboards now have phone and tablet layouts with a compact header and touch-sized filter controls.
  • Rotating share links cycle through several dashboards, each with its own viewing time, filters, and dates.
  • Stashes are editable tables you build by hand or upload from CSV, Excel, or Parquet, then use as sources for Query Datasets, widgets, and filters.
  • The dataset editor now checks keys for duplicates and blank values before you save an incremental dataset.
  • Widgets and datasets show how fresh each source sync is, and open dashboards update as soon as a sync completes.
  • Added duration formatting for chart overlays.
• Roar Designer
  • Charts appear on their own cards that can be resized and added to a dashboard without leaving the conversation.
  • Session Context groups the dashboards, reports, datasets, and workflows a conversation touched, and Run Activity shows live step progress and explains why a step failed.

Improvements

• Dashboards load Query Widgets faster, the app loads faster on first visit, and live metric updates no longer redraw the whole page.
• Dashboards pause background updates when nobody has them open and refresh when you return.
• Open tabs keep working through a release and reconnect on their own after a dropped connection.
• Large syncs run in smaller batches, so wide datasets no longer run out of memory, and repeatedly failing sync batches no longer block the rest.
• ConnectWise text fields now hold up to 10,000 characters.
• Filter value rows toggle with a click, the Apply button stays in view, and filter options sort numbers in numeric order.
• Table previews paginate by default, with D and F keyboard shortcuts to move between pages.
• CSV and Excel exports show a clear warning naming a missing column instead of failing.

Bug Fixes

• Fixed classic drilldown exports so they include only the selected group.
• Fixed dashboard date ranges so they respect the target timezone at the start and end of each day.
• Fixed tables that shifted when a refresh returned the same data, and a refresh spinner that waited on off-screen widgets.
• Fixed share links so viewers see only the filter options their link allows, protected links always ask to unlock before showing data, and drilldowns apply the link's base filters.
• Fixed copying a share link in Safari, and record links in shared views.
• Fixed incremental syncs that could skip a page of history when a write failed partway through.
• ConnectWise: Fixed callback timeouts that blocked dataset deletion, and audit trail dates with milliseconds.
• Fixed adding a Roar Designer chart to a dashboard, and Roar Designer stalling on a chart preview that wasn't on screen.
• Fixed the message box zooming in on iPhone, and chat scrolling snapping back on touch devices.