UniFi Site Manager: Device Offline

Status: available
Severity: medium
Time window: 1h
Group by: Id
Source: github.com/Azure/Azure-Sentinel

Identifies when a UniFi device transitions to offline status, which may indicate a network outage, power loss, or hardware failure requiring attention.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1489` Service Stop

Rule body

id: f3fa4f3f-c8db-ae35-ee06-04de2dfac511
name: "UniFi Site Manager: Device Offline"
description: |
  Identifies when a UniFi device transitions to offline status, which may indicate a network outage, power loss, or hardware failure requiring attention.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: UniFiSiteManagerConnectorDefinition
    dataTypes:
      - Unifi_SiteManager_Devices_CL
queryFrequency: 15m
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1489
subTechniques: []
query: |
  // UniFi Device Offline Detection
  Unifi_SiteManager_Devices_CL
  | where TimeGenerated > ago(1h)
  | summarize arg_max(TimeGenerated, *) by Id
  | where Status == "offline"
  | extend OfflineMinutes = datetime_diff('minute', now(), TimeGenerated)
  | where OfflineMinutes >= 10
  | extend
      DeviceName = coalesce(Name, "Unnamed"),
      DeviceId = Id,
      Model = Model,
      IPAddress = Ip,
      MACAddress = Mac,
      ProductLine = ProductLine,
      FirmwareVersion = Version
  | extend HostName = DeviceName
  | project
      TimeGenerated,
      DeviceName,
      DeviceId,
      Model,
      IPAddress,
      MACAddress,
      ProductLine,
      Status = Status,
      OfflineMinutes,
      FirmwareVersion,
      HostName
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT4H
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.0

Stages and Predicates

Stage 1: `source`

Unifi_SiteManager_Devices_CL

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `summarize`

| summarize arg_max(TimeGenerated, *) by Id

Stage 4: `where`

| where Status == "offline"

Stage 5: `extend`

| extend OfflineMinutes = datetime_diff('minute', now(), TimeGenerated)

Stage 6: `where`

| where OfflineMinutes >= 10

Stage 7: `extend`

| extend
    DeviceName = coalesce(Name, "Unnamed"),
    DeviceId = Id,
    Model = Model,
    IPAddress = Ip,
    MACAddress = Mac,
    ProductLine = ProductLine,
    FirmwareVersion = Version

Stage 8: `extend`

| extend HostName = DeviceName

Stage 9: `project`

| project
    TimeGenerated,
    DeviceName,
    DeviceId,
    Model,
    IPAddress,
    MACAddress,
    ProductLine,
    Status = Status,
    OfflineMinutes,
    FirmwareVersion,
    HostName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`OfflineMinutes`	ge	`10`	`field:"OfflineMinutes" kind:ge value:"10"`
`Status`	eq	`offline`	`field:"Status" kind:eq value:"offline"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DeviceId`	`project`
`DeviceName`	`project`
`FirmwareVersion`	`project`
`HostName`	`project`
`IPAddress`	`project`
`MACAddress`	`project`
`Model`	`project`
`OfflineMinutes`	`project`
`ProductLine`	`project`
`Status`	`project`
`TimeGenerated`	`project`

UniFi Site Manager: Device Offline

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: where

Stage 5: extend

Stage 6: where

Stage 7: extend

Stage 8: extend

Stage 9: project