UniFi Site Manager: Pending firmware updates outstanding for 7d+

Status: available
Severity: low
Time window: 7d
Group by: SiteId, SiteName
Source: github.com/Azure/Azure-Sentinel

Identifies sites with pending firmware updates outstanding continuously for the last 7 days, indicating patch debt that should be scheduled.

MITRE ATT&CK coverage

Tactic	Techniques
Reconnaissance	`T1595` Active Scanning

Rule body

id: d943d401-861e-7186-d42c-c505fbf7c619
name: "UniFi Site Manager: Pending firmware updates outstanding for 7d+"
description: |
  Identifies sites with pending firmware updates outstanding continuously for the last 7 days, indicating patch debt that should be scheduled.
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: UniFiSiteManagerConnectorDefinition
    dataTypes:
      - Unifi_SiteManager_Sites_CL
queryFrequency: 1d
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Reconnaissance
relevantTechniques:
  - T1595
subTechniques: []
query: |
  Unifi_SiteManager_Sites_CL
        | where TimeGenerated > ago(7d)
  | extend pendingUpdates = PendingUpdateDevices
        | summarize MinPending = min(pendingUpdates), MaxPending = max(pendingUpdates), arg_max(TimeGenerated, pendingUpdates) by SiteId, SiteName
        | where MinPending > 0
        | extend Activity = strcat('Pending updates sustained - current ', pendingUpdates, ' device(s)')
        | project TimeGenerated, SiteId, SiteName, Activity, PendingDevices = pendingUpdates
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: SiteId
      - identifier: DnsDomain
        columnName: SiteName
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

Unifi_SiteManager_Sites_CL

Stage 2: `where`

| where TimeGenerated > ago(7d)

Stage 3: `extend`

| extend pendingUpdates = PendingUpdateDevices

Stage 4: `summarize`

| summarize MinPending = min(pendingUpdates), MaxPending = max(pendingUpdates), arg_max(TimeGenerated, pendingUpdates) by SiteId, SiteName

Stage 5: `where`

| where MinPending > 0

Stage 6: `extend`

| extend Activity = strcat('Pending updates sustained - current ', pendingUpdates, ' device(s)')

Stage 7: `project`

| project TimeGenerated, SiteId, SiteName, Activity, PendingDevices = pendingUpdates

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`MinPending`	gt	`0`	`field:"MinPending" kind:gt value:"0"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Activity`	`project`
`PendingDevices`	`project`
`SiteId`	`project`
`SiteName`	`project`
`TimeGenerated`	`project`

UniFi Site Manager: Pending firmware updates outstanding for 7d+

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: summarize

Stage 5: where

Stage 6: extend

Stage 7: project