UniFi Site Manager Data Connector Health | Microsoft Sentinel Analytic Rules

Back


Id	1fb5c195-9bff-e18b-3e8f-5123f46bff9d
Rulename	UniFi Site Manager: Data Connector Health
Description	Identifies when UniFi Site Manager data connectors stop sending data, ensuring visibility into the UniFi estate is maintained.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	UniFiSiteManagerConnectorDefinition
Kind	Scheduled
Query frequency	15m
Query period	2h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi%20Site%20Manager%20%28CCF%29/Analytic%20Rules/UniFiCloudDataConnectorHealth.yaml
Version	1.0.0
Arm template	1fb5c195-9bff-e18b-3e8f-5123f46bff9d.json

KQL

// UniFi Data Connector Health Monitoring
let StaleThreshold = 30;
let DevicesHealth = Unifi_SiteManager_Devices_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Devices_CL", TableDisplay = "Devices";
let HostsHealth = Unifi_SiteManager_Hosts_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Hosts_CL", TableDisplay = "Hosts";
let SitesHealth = Unifi_SiteManager_Sites_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Sites_CL", TableDisplay = "Sites";
let ISPHealth = Unifi_SiteManager_ISPMetrics_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_ISPMetrics_CL", TableDisplay = "ISP Metrics";
union DevicesHealth, HostsHealth, SitesHealth, ISPHealth
| extend 
    MinutesSinceData = datetime_diff('minute', now(), LastReceived),
    Status = case(
        datetime_diff('minute', now(), LastReceived) <= 15, "Healthy",
        datetime_diff('minute', now(), LastReceived) <= 30, "Delayed",
        datetime_diff('minute', now(), LastReceived) <= 60, "Stale",
        "Critical"
    )
| where MinutesSinceData >= StaleThreshold
| extend TimeGenerated = now()
| project
    TimeGenerated,
    TableName,
    TableDisplay,
    LastReceived,
    MinutesSinceData,
    Status

YAML

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi%20Site%20Manager%20%28CCF%29/Analytic%20Rules/UniFiCloudDataConnectorHealth.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - Unifi_SiteManager_Sites_CL
  - Unifi_SiteManager_Devices_CL
  - Unifi_SiteManager_Hosts_CL
  - Unifi_SiteManager_ISPMetrics_CL
  connectorId: UniFiSiteManagerConnectorDefinition
tactics:
- DefenseEvasion
relevantTechniques:
- T1562
kind: Scheduled
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT4H
    reopenClosedIncident: false
    enabled: true
  createIncident: true
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: TableDisplay
  entityType: CloudApplication
description: |
  Identifies when UniFi Site Manager data connectors stop sending data, ensuring visibility into the UniFi estate is maintained.
triggerOperator: gt
status: Available
subTechniques:
- T1562.006
queryFrequency: 15m
id: 1fb5c195-9bff-e18b-3e8f-5123f46bff9d
name: 'UniFi Site Manager: Data Connector Health'
severity: Medium
query: |
  // UniFi Data Connector Health Monitoring
  let StaleThreshold = 30;
  let DevicesHealth = Unifi_SiteManager_Devices_CL
  | where TimeGenerated > ago(2h)
  | summarize LastReceived = max(TimeGenerated)
  | extend TableName = "Unifi_SiteManager_Devices_CL", TableDisplay = "Devices";
  let HostsHealth = Unifi_SiteManager_Hosts_CL
  | where TimeGenerated > ago(2h)
  | summarize LastReceived = max(TimeGenerated)
  | extend TableName = "Unifi_SiteManager_Hosts_CL", TableDisplay = "Hosts";
  let SitesHealth = Unifi_SiteManager_Sites_CL
  | where TimeGenerated > ago(2h)
  | summarize LastReceived = max(TimeGenerated)
  | extend TableName = "Unifi_SiteManager_Sites_CL", TableDisplay = "Sites";
  let ISPHealth = Unifi_SiteManager_ISPMetrics_CL
  | where TimeGenerated > ago(2h)
  | summarize LastReceived = max(TimeGenerated)
  | extend TableName = "Unifi_SiteManager_ISPMetrics_CL", TableDisplay = "ISP Metrics";
  union DevicesHealth, HostsHealth, SitesHealth, ISPHealth
  | extend 
      MinutesSinceData = datetime_diff('minute', now(), LastReceived),
      Status = case(
          datetime_diff('minute', now(), LastReceived) <= 15, "Healthy",
          datetime_diff('minute', now(), LastReceived) <= 30, "Delayed",
          datetime_diff('minute', now(), LastReceived) <= 60, "Stale",
          "Critical"
      )
  | where MinutesSinceData >= StaleThreshold
  | extend TimeGenerated = now()
  | project
      TimeGenerated,
      TableName,
      TableDisplay,
      LastReceived,
      MinutesSinceData,
      Status
queryPeriod: 2h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1fb5c195-9bff-e18b-3e8f-5123f46bff9d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1fb5c195-9bff-e18b-3e8f-5123f46bff9d')]",
      "properties": {
        "alertRuleTemplateName": "1fb5c195-9bff-e18b-3e8f-5123f46bff9d",
        "customDetails": null,
        "description": "Identifies when UniFi Site Manager data connectors stop sending data, ensuring visibility into the UniFi estate is maintained.\n",
        "displayName": "UniFi Site Manager: Data Connector Health",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "TableDisplay",
                "identifier": "Name"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT4H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi%20Site%20Manager%20%28CCF%29/Analytic%20Rules/UniFiCloudDataConnectorHealth.yaml",
        "query": "// UniFi Data Connector Health Monitoring\nlet StaleThreshold = 30;\nlet DevicesHealth = Unifi_SiteManager_Devices_CL\n| where TimeGenerated > ago(2h)\n| summarize LastReceived = max(TimeGenerated)\n| extend TableName = \"Unifi_SiteManager_Devices_CL\", TableDisplay = \"Devices\";\nlet HostsHealth = Unifi_SiteManager_Hosts_CL\n| where TimeGenerated > ago(2h)\n| summarize LastReceived = max(TimeGenerated)\n| extend TableName = \"Unifi_SiteManager_Hosts_CL\", TableDisplay = \"Hosts\";\nlet SitesHealth = Unifi_SiteManager_Sites_CL\n| where TimeGenerated > ago(2h)\n| summarize LastReceived = max(TimeGenerated)\n| extend TableName = \"Unifi_SiteManager_Sites_CL\", TableDisplay = \"Sites\";\nlet ISPHealth = Unifi_SiteManager_ISPMetrics_CL\n| where TimeGenerated > ago(2h)\n| summarize LastReceived = max(TimeGenerated)\n| extend TableName = \"Unifi_SiteManager_ISPMetrics_CL\", TableDisplay = \"ISP Metrics\";\nunion DevicesHealth, HostsHealth, SitesHealth, ISPHealth\n| extend \n    MinutesSinceData = datetime_diff('minute', now(), LastReceived),\n    Status = case(\n        datetime_diff('minute', now(), LastReceived) <= 15, \"Healthy\",\n        datetime_diff('minute', now(), LastReceived) <= 30, \"Delayed\",\n        datetime_diff('minute', now(), LastReceived) <= 60, \"Stale\",\n        \"Critical\"\n    )\n| where MinutesSinceData >= StaleThreshold\n| extend TimeGenerated = now()\n| project\n    TimeGenerated,\n    TableName,\n    TableDisplay,\n    LastReceived,\n    MinutesSinceData,\n    Status\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT2H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}