Liongard Systems & Data

Overview

Systems are the entities discovered during Liongard inspections. When a launchpoint runs an inspection, it discovers systems such as servers, firewalls, cloud services, user accounts, domain controllers, and other infrastructure components. Each system contains detailed configuration data captured at the time of inspection, providing a historical record of the IT environment.

System Fields

Core Fields

Extended Fields

API Patterns

List All Systems

GET /api/v1/systems?page=1&pageSize=100
X-ROAR-API-KEY: {api_key}

Response:

{
  "Data": [
    {
      "ID": 10001,
      "Name": "DC01.acme.local",
      "InspectorID": 100,
      "InspectorName": "Active Directory",
      "LaunchpointID": 5001,
      "LaunchpointName": "Acme Corp - Active Directory",
      "EnvironmentID": 1234,
      "EnvironmentName": "Acme Corporation",
      "Status": "Active",
      "LastInspection": "2024-02-15T02:15:00Z",
      "SystemType": "Domain Controller",
      "CreatedOn": "2023-06-01T10:30:00Z",
      "UpdatedOn": "2024-02-15T02:15:00Z"
    }
  ],
  "TotalRows": 2500,
  "HasMoreRows": true,
  "CurrentPage": 1,
  "TotalPages": 25,
  "PageSize": 100
}

Filter Systems by Environment

GET /api/v1/systems?environmentId={environmentId}&page=1&pageSize=100
X-ROAR-API-KEY: {api_key}

Filter Systems by Inspector

GET /api/v1/systems?inspectorId={inspectorId}&page=1&pageSize=100
X-ROAR-API-KEY: {api_key}

Filter Systems by Launchpoint

GET /api/v1/systems?launchpointId={launchpointId}&page=1&pageSize=100
X-ROAR-API-KEY: {api_key}

Get System by ID

GET /api/v1/systems/{systemId}
X-ROAR-API-KEY: {api_key}

Response:

{
  "ID": 10001,
  "Name": "DC01.acme.local",
  "InspectorID": 100,
  "InspectorName": "Active Directory",
  "LaunchpointID": 5001,
  "LaunchpointName": "Acme Corp - Active Directory",
  "EnvironmentID": 1234,
  "EnvironmentName": "Acme Corporation",
  "Status": "Active",
  "LastInspection": "2024-02-15T02:15:00Z",
  "SystemType": "Domain Controller",
  "DetailCount": 45,
  "DetectionCount": 2,
  "CreatedOn": "2023-06-01T10:30:00Z",
  "UpdatedOn": "2024-02-15T02:15:00Z"
}

System Details

What Are System Details?

System details contain the raw configuration data captured during inspections. This is the actual IT documentation data -- user lists, firewall rules, backup statuses, license counts, security settings, and more. Details are stored as structured JSON and can be queried using JMESPath expressions via the dataprints API.

Get System Detail

GET /api/v1/systems/{systemId}/detail
X-ROAR-API-KEY: {api_key}

Response (example for Active Directory system):

{
  "SystemID": 10001,
  "InspectionDate": "2024-02-15T02:15:00Z",
  "Data": {
    "DomainName": "acme.local",
    "FunctionalLevel": "Windows2016Domain",
    "DomainControllers": [
      {
        "Name": "DC01",
        "IPAddress": "10.0.1.10",
        "OperatingSystem": "Windows Server 2022",
        "FSMORoles": ["PDCEmulator", "RIDMaster"]
      },
      {
        "Name": "DC02",
        "IPAddress": "10.0.1.11",
        "OperatingSystem": "Windows Server 2022",
        "FSMORoles": ["InfrastructureMaster"]
      }
    ],
    "Users": {
      "TotalCount": 150,
      "EnabledCount": 142,
      "DisabledCount": 8,
      "LockedOutCount": 0
    },
    "Groups": {
      "TotalCount": 85,
      "SecurityGroups": 60,
      "DistributionGroups": 25
    },
    "GroupPolicyObjects": {
      "TotalCount": 12,
      "LinkedCount": 10,
      "UnlinkedCount": 2
    },
    "PasswordPolicy": {
      "MinimumLength": 12,
      "ComplexityEnabled": true,
      "MaxAge": 90,
      "MinAge": 1,
      "HistoryCount": 24,
      "LockoutThreshold": 5,
      "LockoutDuration": 30
    }
  }
}

Historical Detail Snapshots

System details maintain historical snapshots for comparison:

GET /api/v1/systems/{systemId}/detail?date=2024-01-15
X-ROAR-API-KEY: {api_key}

Dataprints

What Are Dataprints?

Dataprints provide a way to extract specific data from system details using JMESPath expressions. Instead of fetching the entire system detail and parsing it client-side, you can use dataprints to query exactly the data you need.

Evaluate Dataprint by System Detail ID

POST /api/v2/dataprints-evaluate-systemdetailid
X-ROAR-API-KEY: {api_key}
Content-Type: application/json

{
  "SystemDetailID": 10001,
  "Expression": "Data.Users.TotalCount"
}

Response:

{
  "Result": 150
}

Complex JMESPath Examples

Get all domain controller names:

{
  "SystemDetailID": 10001,
  "Expression": "Data.DomainControllers[*].Name"
}

Response:

{
  "Result": ["DC01", "DC02"]
}

Get users with specific criteria:

{
  "SystemDetailID": 10001,
  "Expression": "Data.DomainControllers[?OperatingSystem=='Windows Server 2022'].Name"
}

Extract nested configuration:

{
  "SystemDetailID": 10001,
  "Expression": "Data.PasswordPolicy.{MinLength: MinimumLength, Complexity: ComplexityEnabled, MaxAge: MaxAge}"
}

Response:

{
  "Result": {
    "MinLength": 12,
    "Complexity": true,
    "MaxAge": 90
  }
}

JMESPath Quick Reference

Asset Inventory (v2)

Identity Profiles

Asset Inventory aggregates user identities discovered across all inspections:

GET /api/v2/inventory/identities?page=1&pageSize=100
X-ROAR-API-KEY: {api_key}

Response:

{
  "Data": [
    {
      "ID": "identity-uuid-1234",
      "DisplayName": "John Smith",
      "Email": "[email protected]",
      "EnvironmentID": 1234,
      "Sources": [
        {
          "Inspector": "Active Directory",
          "SystemID": 10001,
          "Username": "jsmith",
          "Status": "Enabled"
        },
        {
          "Inspector": "Microsoft 365",
          "SystemID": 10050,
          "Username": "[email protected]",
          "LicenseAssigned": true
        }
      ],
      "LastSeen": "2024-02-15T02:15:00Z"
    }
  ],
  "TotalRows": 500,
  "HasMoreRows": true,
  "CurrentPage": 1,
  "TotalPages": 5,
  "PageSize": 100
}

Get Identity by ID

GET /api/v2/inventory/identities/{identityId}
X-ROAR-API-KEY: {api_key}

Device Profiles

Asset Inventory also aggregates device information:

GET /api/v2/inventory/devices?page=1&pageSize=100
X-ROAR-API-KEY: {api_key}

Response:

{
  "Data": [
    {
      "ID": "device-uuid-5678",
      "Hostname": "SERVER-DC01",
      "EnvironmentID": 1234,
      "IPAddresses": ["10.0.1.10"],
      "OperatingSystem": "Windows Server 2022",
      "Sources": [
        {
          "Inspector": "Active Directory",
          "SystemID": 10001,
          "Role": "Domain Controller"
        },
        {
          "Inspector": "VMware vSphere",
          "SystemID": 10100,
          "VMName": "DC01-VM"
        }
      ],
      "LastSeen": "2024-02-15T02:15:00Z"
    }
  ],
  "TotalRows": 800,
  "HasMoreRows": true,
  "CurrentPage": 1,
  "TotalPages": 8,
  "PageSize": 100
}

Get Device by ID

GET /api/v2/inventory/devices/{deviceId}
X-ROAR-API-KEY: {api_key}

Common Workflows

Finding Systems by Environment

async function getEnvironmentSystems(environmentId) {
  const systems = [];
  let page = 1;
  let hasMore = true;

  while (hasMore) {
    const response = await fetch(
      `https://${instance}.app.liongard.com/api/v1/systems?environmentId=${environmentId}&page=${page}&pageSize=500`,
      {
        headers: { 'X-ROAR-API-KEY': process.env.LIONGARD_API_KEY }
      }
    );

    const data = await response.json();
    systems.push(...data.Data);
    hasMore = data.HasMoreRows;
    page++;
  }

  return systems;
}

Extracting Configuration Data

async function getPasswordPolicy(systemDetailId) {
  const response = await fetch(
    `https://${instance}.app.liongard.com/api/v2/dataprints-evaluate-systemdetailid`,
    {
      method: 'POST',
      headers: {
        'X-ROAR-API-KEY': process.env.LIONGARD_API_KEY,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        SystemDetailID: systemDetailId,
        Expression: 'Data.PasswordPolicy'
      })
    }
  );

  return response.json();
}

Comparing System Snapshots

1. Get current detail - Fetch latest system detail
2. Get historical detail - Fetch detail from a specific date
3. Compare data - Diff the two snapshots
4. Identify changes - Note what configuration items changed

Cross-Platform Asset Correlation

1. Query identities - Get all identities for an environment
2. Review sources - See which platforms each identity appears in
3. Identify gaps - Find users missing from expected platforms
4. Check status - Verify enabled/disabled status across platforms
5. Report findings - Generate cross-platform identity report

Error Handling

Common API Errors

JMESPath Errors

Best Practices

1. Use dataprints for specific data - Avoid fetching entire system details when you only need a few fields
2. Cache system lists - Systems change infrequently, cache for minutes
3. Filter by environment - Always scope queries to specific environments
4. Handle null data - Some systems may not have all expected fields
5. Use pagination - Never fetch unbounded system lists
6. Monitor detail counts - Track detail count changes for data quality
7. Leverage asset inventory - Use identities and devices for cross-platform views

Data Relationships

System (SystemID)
    |
    +-- Inspector (InspectorID)
    +-- Launchpoint (LaunchpointID)
    +-- Environment (EnvironmentID)
    |
    +-- System Details
    |       +-- Raw Configuration Data (JSON)
    |       +-- Historical Snapshots
    |       +-- Dataprints (JMESPath queries)
    |
    +-- Detections (DetectionID)
    |
    +-- Asset Inventory
            +-- Identity Profiles
            +-- Device Profiles

Related Skills

• Liongard Overview - Platform overview and terminology
• Liongard Environments - Environment management
• Liongard Inspections - Inspectors and launchpoints
• Liongard Detections - Change detection and alerts