UniFi Site Manager: WiFi quality degraded (high TX retry)

Status: available
Severity: low
Time window: 1h
Group by: SiteId, SiteName
Source: github.com/Azure/Azure-Sentinel

Identifies when the site-wide WiFi TX retry rate exceeds 5 percent, which may indicate RF interference, channel congestion, or active wireless attack.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1498` Network Denial of Service

Rule body

id: f5130582-9e0e-cb47-af0b-dcd8b261fa04
name: "UniFi Site Manager: WiFi quality degraded (high TX retry)"
description: |
  Identifies when the site-wide WiFi TX retry rate exceeds 5 percent, which may indicate RF interference, channel congestion, or active wireless attack.
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: UniFiSiteManagerConnectorDefinition
    dataTypes:
      - Unifi_SiteManager_Sites_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1498
subTechniques:
  - T1498.001
query: |
  Unifi_SiteManager_Sites_CL
        | where TimeGenerated > ago(1h)
  | extend txRetry = WifiTxRetryPct
        | where txRetry > 5.0
        | summarize arg_max(TimeGenerated, *) by SiteId, SiteName
        | extend Activity = strcat('TX retry rate ', round(txRetry, 1), '% (>5% threshold)')
        | project TimeGenerated, SiteId, SiteName, Activity, TxRetryPct = round(txRetry, 1)
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: SiteId
      - identifier: DnsDomain
        columnName: SiteName
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

Unifi_SiteManager_Sites_CL

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `extend`

| extend txRetry = WifiTxRetryPct

Stage 4: `where`

| where txRetry > 5.0

Stage 5: `summarize`

| summarize arg_max(TimeGenerated, *) by SiteId, SiteName

Stage 6: `extend`

| extend Activity = strcat('TX retry rate ', round(txRetry, 1), '% (>5% threshold)')

Stage 7: `project`

| project TimeGenerated, SiteId, SiteName, Activity, TxRetryPct = round(txRetry, 1)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`txRetry`	gt	`5.0`	`field:"txRetry" kind:gt value:"5.0"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Activity`	`project`
`SiteId`	`project`
`SiteName`	`project`
`TimeGenerated`	`project`
`TxRetryPct`	`project`

UniFi Site Manager: WiFi quality degraded (high TX retry)

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: where

Stage 5: summarize

Stage 6: extend

Stage 7: project