UniFi Site Manager: New Device Adopted

Status: available
Severity: informational
Time window: 1h
Group by: Id
Source: github.com/Azure/Azure-Sentinel

Identifies when a new device is adopted into the UniFi network. While often legitimate, unexpected adoptions may indicate unauthorized hardware additions.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1200` Hardware Additions
Persistence	`T1133` External Remote Services

Rule body

id: e69be544-9476-35bb-2533-fa8c650dcd46
name: "UniFi Site Manager: New Device Adopted"
description: |
  Identifies when a new device is adopted into the UniFi network. While often legitimate, unexpected adoptions may indicate unauthorized hardware additions.
severity: Informational
status: Available
requiredDataConnectors:
  - connectorId: UniFiSiteManagerConnectorDefinition
    dataTypes:
      - Unifi_SiteManager_Devices_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Persistence
relevantTechniques:
  - T1200
  - T1133
subTechniques: []
query: |
  // UniFi New Device Adopted Detection
  Unifi_SiteManager_Devices_CL
  | where TimeGenerated > ago(1h)
  | where isnotempty(AdoptionTime)
  | extend AdoptionDateTime = todatetime(AdoptionTime)
  | where AdoptionDateTime > ago(1h)
  | summarize arg_max(TimeGenerated, *) by Id
  | extend
      DeviceName = coalesce(Name, "Unnamed"),
      DeviceId = Id,
      Model = Model,
      IPAddress = Ip,
      MACAddress = Mac,
      ProductLine = ProductLine,
      FirmwareVersion = Version,
      Shortname = Shortname
  | extend HostName = DeviceName
  | project
      TimeGenerated,
      AdoptionTime = AdoptionDateTime,
      DeviceName,
      DeviceId,
      Model,
      IPAddress,
      MACAddress,
      ProductLine,
      Status = Status,
      FirmwareVersion,
      Shortname,
      HostName
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT24H
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.0

Stages and Predicates

Stage 1: `source`

Unifi_SiteManager_Devices_CL

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `where`

| where isnotempty(AdoptionTime)

Stage 4: `extend`

| extend AdoptionDateTime = todatetime(AdoptionTime)

Stage 5: `where`

| where AdoptionDateTime > ago(1h)

Stage 6: `summarize`

| summarize arg_max(TimeGenerated, *) by Id

Stage 7: `extend`

| extend
    DeviceName = coalesce(Name, "Unnamed"),
    DeviceId = Id,
    Model = Model,
    IPAddress = Ip,
    MACAddress = Mac,
    ProductLine = ProductLine,
    FirmwareVersion = Version,
    Shortname = Shortname

Stage 8: `extend`

| extend HostName = DeviceName

Stage 9: `project`

| project
    TimeGenerated,
    AdoptionTime = AdoptionDateTime,
    DeviceName,
    DeviceId,
    Model,
    IPAddress,
    MACAddress,
    ProductLine,
    Status = Status,
    FirmwareVersion,
    Shortname,
    HostName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AdoptionTime`	is_not_null	(no value, null check)	`field:"AdoptionTime" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AdoptionTime`	`project`
`DeviceId`	`project`
`DeviceName`	`project`
`FirmwareVersion`	`project`
`HostName`	`project`
`IPAddress`	`project`
`MACAddress`	`project`
`Model`	`project`
`ProductLine`	`project`
`Shortname`	`project`
`Status`	`project`
`TimeGenerated`	`project`

UniFi Site Manager: New Device Adopted

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: where

Stage 6: summarize

Stage 7: extend

Stage 8: extend

Stage 9: project