UniFi Site Manager Data Connector Health | Microsoft Sentinel Analytic Rules

Back


Id	1fb5c195-9bff-e18b-3e8f-5123f46bff9d
Rulename	UniFi Site Manager: Data Connector Health
Description	Identifies when UniFi Site Manager data connectors stop sending data, ensuring visibility into the UniFi estate is maintained.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	UniFiSiteManagerConnectorDefinition
Kind	Scheduled
Query frequency	15m
Query period	2h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi%20Site%20Manager%20%28CCF%29/Analytic%20Rules/UniFiCloudDataConnectorHealth.yaml
Version	1.0.0
Arm template	1fb5c195-9bff-e18b-3e8f-5123f46bff9d.json

KQL

// UniFi Data Connector Health Monitoring
let StaleThreshold = 30;
let DevicesHealth = Unifi_SiteManager_Devices_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Devices_CL", TableDisplay = "Devices";
let HostsHealth = Unifi_SiteManager_Hosts_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Hosts_CL", TableDisplay = "Hosts";
let SitesHealth = Unifi_SiteManager_Sites_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Sites_CL", TableDisplay = "Sites";
let ISPHealth = Unifi_SiteManager_ISPMetrics_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_ISPMetrics_CL", TableDisplay = "ISP Metrics";
union DevicesHealth, HostsHealth, SitesHealth, ISPHealth
| extend 
    MinutesSinceData = datetime_diff('minute', now(), LastReceived),
    Status = case(
        datetime_diff('minute', now(), LastReceived) <= 15, "Healthy",
        datetime_diff('minute', now(), LastReceived) <= 30, "Delayed",
        datetime_diff('minute', now(), LastReceived) <= 60, "Stale",
        "Critical"
    )
| where MinutesSinceData >= StaleThreshold
| extend TimeGenerated = now()
| project
    TimeGenerated,
    TableName,
    TableDisplay,
    LastReceived,
    MinutesSinceData,
    Status

YAML

subTechniques:
- T1562.006
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT4H
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: true
  createIncident: true
name: 'UniFi Site Manager: Data Connector Health'
triggerOperator: gt
query: |
  // UniFi Data Connector Health Monitoring
  let StaleThreshold = 30;
  let DevicesHealth = Unifi_SiteManager_Devices_CL
  | where TimeGenerated > ago(2h)
  | summarize LastReceived = max(TimeGenerated)
  | extend TableName = "Unifi_SiteManager_Devices_CL", TableDisplay = "Devices";
  let HostsHealth = Unifi_SiteManager_Hosts_CL
  | where TimeGenerated > ago(2h)
  | summarize LastReceived = max(TimeGenerated)
  | extend TableName = "Unifi_SiteManager_Hosts_CL", TableDisplay = "Hosts";
  let SitesHealth = Unifi_SiteManager_Sites_CL
  | where TimeGenerated > ago(2h)
  | summarize LastReceived = max(TimeGenerated)
  | extend TableName = "Unifi_SiteManager_Sites_CL", TableDisplay = "Sites";
  let ISPHealth = Unifi_SiteManager_ISPMetrics_CL
  | where TimeGenerated > ago(2h)
  | summarize LastReceived = max(TimeGenerated)
  | extend TableName = "Unifi_SiteManager_ISPMetrics_CL", TableDisplay = "ISP Metrics";
  union DevicesHealth, HostsHealth, SitesHealth, ISPHealth
  | extend 
      MinutesSinceData = datetime_diff('minute', now(), LastReceived),
      Status = case(
          datetime_diff('minute', now(), LastReceived) <= 15, "Healthy",
          datetime_diff('minute', now(), LastReceived) <= 30, "Delayed",
          datetime_diff('minute', now(), LastReceived) <= 60, "Stale",
          "Critical"
      )
  | where MinutesSinceData >= StaleThreshold
  | extend TimeGenerated = now()
  | project
      TimeGenerated,
      TableName,
      TableDisplay,
      LastReceived,
      MinutesSinceData,
      Status
queryFrequency: 15m
description: |
  Identifies when UniFi Site Manager data connectors stop sending data, ensuring visibility into the UniFi estate is maintained.
id: 1fb5c195-9bff-e18b-3e8f-5123f46bff9d
triggerThreshold: 0
queryPeriod: 2h
version: 1.0.0
kind: Scheduled
status: Available
severity: Medium
requiredDataConnectors:
- connectorId: UniFiSiteManagerConnectorDefinition
  dataTypes:
  - Unifi_SiteManager_Sites_CL
  - Unifi_SiteManager_Devices_CL
  - Unifi_SiteManager_Hosts_CL
  - Unifi_SiteManager_ISPMetrics_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi%20Site%20Manager%20%28CCF%29/Analytic%20Rules/UniFiCloudDataConnectorHealth.yaml
relevantTechniques:
- T1562
tactics:
- DefenseEvasion
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: TableDisplay
  entityType: CloudApplication

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1fb5c195-9bff-e18b-3e8f-5123f46bff9d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1fb5c195-9bff-e18b-3e8f-5123f46bff9d')]",
      "properties": {
        "alertRuleTemplateName": "1fb5c195-9bff-e18b-3e8f-5123f46bff9d",
        "customDetails": null,
        "description": "Identifies when UniFi Site Manager data connectors stop sending data, ensuring visibility into the UniFi estate is maintained.\n",
        "displayName": "UniFi Site Manager: Data Connector Health",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "TableDisplay",
                "identifier": "Name"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT4H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi%20Site%20Manager%20%28CCF%29/Analytic%20Rules/UniFiCloudDataConnectorHealth.yaml",
        "query": "// UniFi Data Connector Health Monitoring\nlet StaleThreshold = 30;\nlet DevicesHealth = Unifi_SiteManager_Devices_CL\n| where TimeGenerated > ago(2h)\n| summarize LastReceived = max(TimeGenerated)\n| extend TableName = \"Unifi_SiteManager_Devices_CL\", TableDisplay = \"Devices\";\nlet HostsHealth = Unifi_SiteManager_Hosts_CL\n| where TimeGenerated > ago(2h)\n| summarize LastReceived = max(TimeGenerated)\n| extend TableName = \"Unifi_SiteManager_Hosts_CL\", TableDisplay = \"Hosts\";\nlet SitesHealth = Unifi_SiteManager_Sites_CL\n| where TimeGenerated > ago(2h)\n| summarize LastReceived = max(TimeGenerated)\n| extend TableName = \"Unifi_SiteManager_Sites_CL\", TableDisplay = \"Sites\";\nlet ISPHealth = Unifi_SiteManager_ISPMetrics_CL\n| where TimeGenerated > ago(2h)\n| summarize LastReceived = max(TimeGenerated)\n| extend TableName = \"Unifi_SiteManager_ISPMetrics_CL\", TableDisplay = \"ISP Metrics\";\nunion DevicesHealth, HostsHealth, SitesHealth, ISPHealth\n| extend \n    MinutesSinceData = datetime_diff('minute', now(), LastReceived),\n    Status = case(\n        datetime_diff('minute', now(), LastReceived) <= 15, \"Healthy\",\n        datetime_diff('minute', now(), LastReceived) <= 30, \"Delayed\",\n        datetime_diff('minute', now(), LastReceived) <= 60, \"Stale\",\n        \"Critical\"\n    )\n| where MinutesSinceData >= StaleThreshold\n| extend TimeGenerated = now()\n| project\n    TimeGenerated,\n    TableName,\n    TableDisplay,\n    LastReceived,\n    MinutesSinceData,\n    Status\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT2H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}