Liongard Detections

Liongard Change Detection & Alerts

Overview

Detections are Liongard's automated change and anomaly detection system. Every time an inspection runs, Liongard compares the new data with previous inspection results and identifies changes. These changes become detections that MSPs can monitor, investigate, and act upon.

The detection ecosystem includes:

• Detections - Automated change/anomaly alerts from inspection comparisons
• Alerts - Configurable rules that trigger notifications based on detection criteria
• Metrics - Custom measurements tracked across systems and environments
• Timeline - Comprehensive audit trail of all platform events

Detections

What Are Detections?

Detections represent specific changes identified between inspection runs. When Liongard inspects a system and finds that something has changed since the previous inspection, it creates a detection record. Examples include:

• A new user account was created in Active Directory
• A firewall rule was modified on a SonicWall
• An MFA policy was disabled in Microsoft 365
• A backup job failed on a Datto appliance
• A new device joined the network on Meraki
• A certificate is expiring within 30 days

Detection Fields

| Field | Type | Description | |-------|------|-------------| | ID | int | Unique detection identifier | | Type | string | Detection type (Added, Removed, Changed, Threshold) | | Severity | string | Critical, High, Medium, Low, Info | | SystemID | int | System where detection occurred | | SystemName | string | System display name | | EnvironmentID | int | Parent environment | | EnvironmentName | string | Environment display name | | InspectorName | string | Inspector that triggered detection | | Status | string | New, Acknowledged, Resolved, Dismissed | | Summary | string | Brief description of the change | | Details | object | Detailed before/after data | | DetectedOn | datetime | When the change was detected | | AcknowledgedOn | datetime | When acknowledged by user | | ResolvedOn | datetime | When marked resolved |

Detection Types

| Type | Description | Example | |------|-------------|---------| | Added | New item discovered | New user account created | | Removed | Item no longer present | Device removed from network | | Changed | Existing item modified | Firewall rule updated | | Threshold | Value crossed a defined threshold | Disk usage exceeded 90% |

Detection Severity Levels

| Severity | Description | Typical Use | |----------|-------------|-------------| | Critical | Immediate action required | Security policy disabled, admin account compromised | | High | Urgent attention needed | MFA disabled, backup failure | | Medium | Review within business hours | Configuration change, new admin user | | Low | Informational but notable | New standard user, minor setting change | | Info | Routine change logged | Regular updates, expected modifications |

Query Detections (v1)

POST /api/v1/detections
X-ROAR-API-KEY: {api_key}
Content-Type: application/json

{
  "Pagination": {
    "Page": 1,
    "PageSize": 100
  },
  "conditions": [
    {
      "path": "EnvironmentID",
      "op": "eq",
      "value": 1234
    },
    {
      "path": "Severity",
      "op": "in",
      "value": ["Critical", "High"]
    },
    {
      "path": "Status",
      "op": "eq",
      "value": "New"
    }
  ],
  "orderBy": [
    {
      "path": "DetectedOn",
      "direction": "desc"
    }
  ]
}

Response:

{
  "Data": [
    {
      "ID": 80001,
      "Type": "Changed",
      "Severity": "High",
      "SystemID": 10001,
      "SystemName": "DC01.acme.local",
      "EnvironmentID": 1234,
      "EnvironmentName": "Acme Corporation",
      "InspectorName": "Active Directory",
      "Status": "New",
      "Summary": "Password policy minimum length changed from 12 to 8",
      "Details": {
        "Before": {
          "PasswordPolicy.MinimumLength": 12
        },
        "After": {
          "PasswordPolicy.MinimumLength": 8
        }
      },
      "DetectedOn": "2024-02-15T02:15:00Z"
    }
  ],
  "TotalRows": 15,
  "HasMoreRows": false,
  "CurrentPage": 1,
  "TotalPages": 1,
  "PageSize": 100
}

Query Detections (v2)

The v2 endpoint provides enhanced filtering and field selection:

POST /api/v2/detections
X-ROAR-API-KEY: {api_key}
Content-Type: application/json

{
  "Pagination": {
    "Page": 1,
    "PageSize": 100
  },
  "conditions": [
    {
      "path": "DetectedOn",
      "op": "gte",
      "value": "2024-02-01T00:00:00Z"
    },
    {
      "path": "Severity",
      "op": "eq",
      "value": "Critical"
    }
  ],
  "fields": ["ID", "Type", "Severity", "SystemName", "EnvironmentName", "Summary", "DetectedOn"],
  "orderBy": [
    {
      "path": "DetectedOn",
      "direction": "desc"
    }
  ]
}

Detection Status Transitions

New ───────────────────> Dismissed
  |                          |
  v                          v
Acknowledged ──────> Resolved

Status Descriptions:

• New - Freshly detected, awaiting review
• Acknowledged - Reviewed by an MSP technician
• Resolved - Change has been addressed or accepted
• Dismissed - Change is expected or irrelevant

Alerts

What Are Alerts?

Alerts are configurable rules that define what types of detections should trigger notifications. Alert rules specify:

• Which environments to monitor
• What detection types and severities to watch for
• What notification channels to use (email, webhook, etc.)
• What conditions must be met

List Alert Rules

GET /api/v1/alerts?page=1&pageSize=50
X-ROAR-API-KEY: {api_key}

Response:

{
  "Data": [
    {
      "ID": 2001,
      "Name": "Critical Security Changes",
      "Description": "Alert on critical severity detections across all environments",
      "Enabled": true,
      "Conditions": {
        "Severity": ["Critical"],
        "Type": ["Changed", "Removed"]
      },
      "Notifications": {
        "Email": ["security@msp.com"],
        "Webhook": "https://hooks.slack.com/services/..."
      },
      "CreatedOn": "2023-01-01T00:00:00Z"
    }
  ],
  "TotalRows": 10,
  "HasMoreRows": false,
  "CurrentPage": 1,
  "TotalPages": 1,
  "PageSize": 50
}

Get Alert by ID

GET /api/v1/alerts/{alertId}
X-ROAR-API-KEY: {api_key}

Create Alert Rule

POST /api/v1/alerts
X-ROAR-API-KEY: {api_key}
Content-Type: application/json

{
  "Name": "MFA Disabled Alert",
  "Description": "Alert when MFA is disabled in any M365 tenant",
  "Enabled": true,
  "Conditions": {
    "InspectorName": ["Microsoft 365"],
    "Severity": ["Critical", "High"],
    "Summary": "MFA"
  },
  "Notifications": {
    "Email": ["alerts@msp.com"]
  }
}

Update Alert Rule

PUT /api/v1/alerts/{alertId}
X-ROAR-API-KEY: {api_key}
Content-Type: application/json

{
  "Enabled": false
}

Delete Alert Rule

DELETE /api/v1/alerts/{alertId}
X-ROAR-API-KEY: {api_key}

List Triggered Alerts

GET /api/v1/alerts/triggered?page=1&pageSize=100
X-ROAR-API-KEY: {api_key}

Response:

{
  "Data": [
    {
      "ID": 50001,
      "AlertRuleID": 2001,
      "AlertRuleName": "Critical Security Changes",
      "DetectionID": 80001,
      "EnvironmentName": "Acme Corporation",
      "SystemName": "DC01.acme.local",
      "Summary": "Password policy minimum length changed from 12 to 8",
      "TriggeredOn": "2024-02-15T02:15:30Z",
      "Status": "New"
    }
  ],
  "TotalRows": 5,
  "HasMoreRows": false,
  "CurrentPage": 1,
  "TotalPages": 1,
  "PageSize": 100
}

Metrics

What Are Metrics?

Metrics allow MSPs to define custom measurements that are tracked across systems and environments. Metrics can evaluate specific data points from system details and aggregate results for compliance reporting, health monitoring, and trend analysis.