UniFi Site Manager External WAN IP changed

Back


Id	ef1a293a-9e2b-b087-7816-2610814ed2d4
Rulename	UniFi Site Manager: External WAN IP changed
Description	Identifies when a site reports more than one distinct WAN external IP within an hour, which may indicate ISP DHCP refresh, WAN reconfiguration, or routing hijack.
Severity	High
Tactics	Reconnaissance
Techniques	T1590
Required data connectors	UniFiSiteManagerConnectorDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi Site Manager (CCF)/Analytic Rules/UniFiCloudExternalWANIPchanged.yaml
Version	1.0.0
Arm template	ef1a293a-9e2b-b087-7816-2610814ed2d4.json

KQL

Unifi_SiteManager_Sites_CL
      | where TimeGenerated > ago(1h)
      | extend SiteName = tostring(Meta.name),
               currentIp = tostring(SiteStatistics.wans.WAN.externalIp)
      | where isnotempty(currentIp)
      | summarize DistinctIps = make_set(currentIp), arg_max(TimeGenerated, currentIp) by SiteId, SiteName
      | where array_length(DistinctIps) > 1
      | extend Activity = strcat('WAN IP changed; observed: ', tostring(DistinctIps))
      | project TimeGenerated, SiteId, SiteName, Activity, CurrentIp = currentIp, ObservedIps = DistinctIps

YAML

entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: CurrentIp
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: SiteName
tactics:
- Reconnaissance
requiredDataConnectors:
- dataTypes:
  - Unifi_SiteManager_Sites_CL
  connectorId: UniFiSiteManagerConnectorDefinition
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
  createIncident: true
id: ef1a293a-9e2b-b087-7816-2610814ed2d4
severity: High
subTechniques:
- T1590.005
status: Available
query: |
  Unifi_SiteManager_Sites_CL
        | where TimeGenerated > ago(1h)
        | extend SiteName = tostring(Meta.name),
                 currentIp = tostring(SiteStatistics.wans.WAN.externalIp)
        | where isnotempty(currentIp)
        | summarize DistinctIps = make_set(currentIp), arg_max(TimeGenerated, currentIp) by SiteId, SiteName
        | where array_length(DistinctIps) > 1
        | extend Activity = strcat('WAN IP changed; observed: ', tostring(DistinctIps))
        | project TimeGenerated, SiteId, SiteName, Activity, CurrentIp = currentIp, ObservedIps = DistinctIps  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi Site Manager (CCF)/Analytic Rules/UniFiCloudExternalWANIPchanged.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.0
name: 'UniFi Site Manager: External WAN IP changed'
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1590
description: |
    Identifies when a site reports more than one distinct WAN external IP within an hour, which may indicate ISP DHCP refresh, WAN reconfiguration, or routing hijack.
triggerOperator: gt

ARM