UniFi Site Manager Multiple Devices Offline | Microsoft Sentinel Analytic Rules

Back


Id	9283b576-5350-fca1-3979-dacb6acd1d16
Rulename	UniFi Site Manager: Multiple Devices Offline
Description	Identifies when multiple UniFi devices go offline simultaneously, typically signaling a power outage, upstream connectivity failure, or infrastructure issue requiring investigation.
Severity	High
Tactics	Impact
Techniques	T1489 T1499
Required data connectors	UniFiSiteManagerConnectorDefinition
Kind	Scheduled
Query frequency	15m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi%20Site%20Manager%20%28CCF%29/Analytic%20Rules/UniFiCloudMultipleDevicesOffline.yaml
Version	1.0.3
Arm template	9283b576-5350-fca1-3979-dacb6acd1d16.json

KQL

let prev_offline_ids = Unifi_SiteManager_Devices_CL
    | where TimeGenerated between (ago(45m) .. ago(15m))
    | summarize arg_max(TimeGenerated, *) by Id
    | where Status == "offline"
    | distinct Id;
Unifi_SiteManager_Devices_CL
| where TimeGenerated > ago(15m)
| summarize arg_max(TimeGenerated, *) by Id
| where Status == "offline"
| extend IsNew = Id !in (prev_offline_ids)
| summarize
    OfflineDeviceCount = count(),
    NewlyOfflineCount = countif(IsNew),
    OfflineDevices = make_list(coalesce(Name, Id)),
    NewlyOfflineDevices = make_list_if(coalesce(Name, Id), IsNew),
    ProductLines = make_set(ProductLine)
| where OfflineDeviceCount >= 3
| where NewlyOfflineCount > 0
| extend
    TimeGenerated = now(),
    OfflineDeviceList = strcat_array(OfflineDevices, ", "),
    NewlyOfflineList = strcat_array(NewlyOfflineDevices, ", "),
    AffectedProductLines = strcat_array(ProductLines, ", ")
| extend Activity = strcat(NewlyOfflineCount, ' device(s) newly offline (', OfflineDeviceCount, ' total offline): ', NewlyOfflineList)
| project
    TimeGenerated,
    OfflineDeviceCount,
    NewlyOfflineCount,
    OfflineDeviceList,
    NewlyOfflineList,
    AffectedProductLines,
    Activity

YAML

subTechniques:
- T1499.002
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT4H
    reopenClosedIncident: true
    matchingMethod: AllEntities
    enabled: true
  createIncident: true
name: 'UniFi Site Manager: Multiple Devices Offline'
triggerOperator: gt
query: |
  let prev_offline_ids = Unifi_SiteManager_Devices_CL
      | where TimeGenerated between (ago(45m) .. ago(15m))
      | summarize arg_max(TimeGenerated, *) by Id
      | where Status == "offline"
      | distinct Id;
  Unifi_SiteManager_Devices_CL
  | where TimeGenerated > ago(15m)
  | summarize arg_max(TimeGenerated, *) by Id
  | where Status == "offline"
  | extend IsNew = Id !in (prev_offline_ids)
  | summarize
      OfflineDeviceCount = count(),
      NewlyOfflineCount = countif(IsNew),
      OfflineDevices = make_list(coalesce(Name, Id)),
      NewlyOfflineDevices = make_list_if(coalesce(Name, Id), IsNew),
      ProductLines = make_set(ProductLine)
  | where OfflineDeviceCount >= 3
  | where NewlyOfflineCount > 0
  | extend
      TimeGenerated = now(),
      OfflineDeviceList = strcat_array(OfflineDevices, ", "),
      NewlyOfflineList = strcat_array(NewlyOfflineDevices, ", "),
      AffectedProductLines = strcat_array(ProductLines, ", ")
  | extend Activity = strcat(NewlyOfflineCount, ' device(s) newly offline (', OfflineDeviceCount, ' total offline): ', NewlyOfflineList)
  | project
      TimeGenerated,
      OfflineDeviceCount,
      NewlyOfflineCount,
      OfflineDeviceList,
      NewlyOfflineList,
      AffectedProductLines,
      Activity
queryFrequency: 15m
description: |
  Identifies when multiple UniFi devices go offline simultaneously, typically signaling a power outage, upstream connectivity failure, or infrastructure issue requiring investigation.
id: 9283b576-5350-fca1-3979-dacb6acd1d16
triggerThreshold: 0
queryPeriod: 30m
version: 1.0.3
kind: Scheduled
status: Available
severity: High
requiredDataConnectors:
- connectorId: UniFiSiteManagerConnectorDefinition
  dataTypes:
  - Unifi_SiteManager_Devices_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi%20Site%20Manager%20%28CCF%29/Analytic%20Rules/UniFiCloudMultipleDevicesOffline.yaml
relevantTechniques:
- T1489
- T1499
tactics:
- Impact
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AffectedProductLines
  entityType: CloudApplication

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9283b576-5350-fca1-3979-dacb6acd1d16')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9283b576-5350-fca1-3979-dacb6acd1d16')]",
      "properties": {
        "alertRuleTemplateName": "9283b576-5350-fca1-3979-dacb6acd1d16",
        "customDetails": null,
        "description": "Identifies when multiple UniFi devices go offline simultaneously, typically signaling a power outage, upstream connectivity failure, or infrastructure issue requiring investigation.\n",
        "displayName": "UniFi Site Manager: Multiple Devices Offline",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "AffectedProductLines",
                "identifier": "Name"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT4H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": true
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi%20Site%20Manager%20%28CCF%29/Analytic%20Rules/UniFiCloudMultipleDevicesOffline.yaml",
        "query": "let prev_offline_ids = Unifi_SiteManager_Devices_CL\n    | where TimeGenerated between (ago(45m) .. ago(15m))\n    | summarize arg_max(TimeGenerated, *) by Id\n    | where Status == \"offline\"\n    | distinct Id;\nUnifi_SiteManager_Devices_CL\n| where TimeGenerated > ago(15m)\n| summarize arg_max(TimeGenerated, *) by Id\n| where Status == \"offline\"\n| extend IsNew = Id !in (prev_offline_ids)\n| summarize\n    OfflineDeviceCount = count(),\n    NewlyOfflineCount = countif(IsNew),\n    OfflineDevices = make_list(coalesce(Name, Id)),\n    NewlyOfflineDevices = make_list_if(coalesce(Name, Id), IsNew),\n    ProductLines = make_set(ProductLine)\n| where OfflineDeviceCount >= 3\n| where NewlyOfflineCount > 0\n| extend\n    TimeGenerated = now(),\n    OfflineDeviceList = strcat_array(OfflineDevices, \", \"),\n    NewlyOfflineList = strcat_array(NewlyOfflineDevices, \", \"),\n    AffectedProductLines = strcat_array(ProductLines, \", \")\n| extend Activity = strcat(NewlyOfflineCount, ' device(s) newly offline (', OfflineDeviceCount, ' total offline): ', NewlyOfflineList)\n| project\n    TimeGenerated,\n    OfflineDeviceCount,\n    NewlyOfflineCount,\n    OfflineDeviceList,\n    NewlyOfflineList,\n    AffectedProductLines,\n    Activity\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT30M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1489",
          "T1499"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}