UniFi Site Manager: WAN uptime below 99%

Status: available
Severity: medium
Time window: 1h
Group by: SiteId, SiteName
Source: github.com/Azure/Azure-Sentinel

Identifies when site WAN uptime falls below 99 percent, an SLA-grade availability problem. Combine with the ISP Downtime rule for root-cause attribution.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1499` Endpoint Denial of Service

Rule body

id: 2bb29f25-833a-5544-4a8e-9bf6c4d8da56
name: "UniFi Site Manager: WAN uptime below 99%"
description: |
  Identifies when site WAN uptime falls below 99 percent, an SLA-grade availability problem. Combine with the ISP Downtime rule for root-cause attribution.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: UniFiSiteManagerConnectorDefinition
    dataTypes:
      - Unifi_SiteManager_Sites_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1499
subTechniques:
  - T1499.002
query: |
  Unifi_SiteManager_Sites_CL
        | where TimeGenerated > ago(1h)
  | extend wanUptime = WanUptimePct
        | where isnotnull(wanUptime) and wanUptime < 99.0
        | summarize arg_max(TimeGenerated, *) by SiteId, SiteName
        | extend Activity = strcat('WAN uptime ', round(wanUptime, 2), '% (below 99% SLA threshold)')
        | project TimeGenerated, SiteId, SiteName, Activity, WanUptimePct = round(wanUptime, 2)
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: SiteId
      - identifier: DnsDomain
        columnName: SiteName
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

Unifi_SiteManager_Sites_CL

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `extend`

| extend wanUptime = WanUptimePct

Stage 4: `where`

| where isnotnull(wanUptime) and wanUptime < 99.0

Stage 5: `summarize`

| summarize arg_max(TimeGenerated, *) by SiteId, SiteName

Stage 6: `extend`

| extend Activity = strcat('WAN uptime ', round(wanUptime, 2), '% (below 99% SLA threshold)')

Stage 7: `project`

| project TimeGenerated, SiteId, SiteName, Activity, WanUptimePct = round(wanUptime, 2)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`wanUptime`	is_not_null	(no value, null check)	`field:"wanUptime" kind:is_not_null`
`wanUptime`	lt	`99.0`	`field:"wanUptime" kind:lt value:"99.0"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Activity`	`project`
`SiteId`	`project`
`SiteName`	`project`
`TimeGenerated`	`project`
`WanUptimePct`	`project`

UniFi Site Manager: WAN uptime below 99%

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: where

Stage 5: summarize

Stage 6: extend

Stage 7: project