UniFi Site Manager: Site Health Critical

Status: available
Severity: high
Time window: 30m
Group by: SiteId
Source: github.com/Azure/Azure-Sentinel

Identifies when a site has multiple offline devices, indicating significant site-level issues such as a power outage, network failure, or infrastructure problem.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1489` Service Stop `T1499` Endpoint Denial of Service

Rule body

id: c8875ebb-cc6e-14e4-4216-d8b06fd92c90
name: "UniFi Site Manager: Site Health Critical"
description: |
  Identifies when a site has multiple offline devices, indicating significant site-level issues such as a power outage, network failure, or infrastructure problem.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: UniFiSiteManagerConnectorDefinition
    dataTypes:
      - Unifi_SiteManager_Sites_CL
queryFrequency: 15m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1489
  - T1499
subTechniques:
  - T1499.002
query: |
  // UniFi Site Health Critical Detection
  let OfflineThreshold = 3;
  Unifi_SiteManager_Sites_CL
  | where TimeGenerated > ago(30m)
  | summarize arg_max(TimeGenerated, *) by SiteId
  | where OfflineDevices >= OfflineThreshold
  | extend
      AvailabilityPct = round(100.0 * (TotalDevices - OfflineDevices) / TotalDevices, 1),
      TotalClients = WifiClients + WiredClients
  | project
      TimeGenerated,
      SiteId = SiteId,
      SiteName = SiteName,
      TotalDevices = TotalDevices,
      OfflineDevices = OfflineDevices,
      OnlineDevices = TotalDevices - OfflineDevices,
      AvailabilityPct,
      TotalClients,
      WiFiClients = WifiClients,
      WiredClients = WiredClients,
      Timezone = Timezone
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: SiteId
      - identifier: DnsDomain
        columnName: SiteName
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: true
    lookbackDuration: PT4H
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.1

Stages and Predicates

Parameters

let OfflineThreshold = 3;

Stage 1: `source`

Unifi_SiteManager_Sites_CL

Stage 2: `where`

| where TimeGenerated > ago(30m)

Stage 3: `summarize`

| summarize arg_max(TimeGenerated, *) by SiteId

Stage 4: `where`

| where OfflineDevices >= OfflineThreshold

Stage 5: `extend`

| extend
    AvailabilityPct = round(100.0 * (TotalDevices - OfflineDevices) / TotalDevices, 1),
    TotalClients = WifiClients + WiredClients

Stage 6: `project`

| project
    TimeGenerated,
    SiteId = SiteId,
    SiteName = SiteName,
    TotalDevices = TotalDevices,
    OfflineDevices = OfflineDevices,
    OnlineDevices = TotalDevices - OfflineDevices,
    AvailabilityPct,
    TotalClients,
    WiFiClients = WifiClients,
    WiredClients = WiredClients,
    Timezone = Timezone

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`OfflineDevices`	ge	`3`	`field:"OfflineDevices" kind:ge value:"3"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AvailabilityPct`	`project`
`OfflineDevices`	`project`
`OnlineDevices`	`project`
`SiteId`	`project`
`SiteName`	`project`
`TimeGenerated`	`project`
`Timezone`	`project`
`TotalClients`	`project`
`TotalDevices`	`project`
`WiFiClients`	`project`
`WiredClients`	`project`

UniFi Site Manager: Site Health Critical

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: where

Stage 5: extend

Stage 6: project