UniFi Site Manager WiFi quality degraded high TX retry

Back


Id	f5130582-9e0e-cb47-af0b-dcd8b261fa04
Rulename	UniFi Site Manager: WiFi quality degraded (high TX retry)
Description	Identifies when the site-wide WiFi TX retry rate exceeds 5 percent, which may indicate RF interference, channel congestion, or active wireless attack.
Severity	Low
Tactics	Impact
Techniques	T1498
Required data connectors	UniFiSiteManagerConnectorDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi Site Manager (CCF)/Analytic Rules/UniFiCloudWiFiqualitydegradedhighTXretry.yaml
Version	1.0.1
Arm template	f5130582-9e0e-cb47-af0b-dcd8b261fa04.json

KQL

Unifi_SiteManager_Sites_CL
      | where TimeGenerated > ago(1h)
| extend txRetry = WifiTxRetryPct
      | where txRetry > 5.0
      | summarize arg_max(TimeGenerated, *) by SiteId, SiteName
      | extend Activity = strcat('TX retry rate ', round(txRetry, 1), '% (>5% threshold)')
      | project TimeGenerated, SiteId, SiteName, Activity, TxRetryPct = round(txRetry, 1)

YAML

entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: SiteId
  - identifier: DnsDomain
    columnName: SiteName
tactics:
- Impact
requiredDataConnectors:
- dataTypes:
  - Unifi_SiteManager_Sites_CL
  connectorId: UniFiSiteManagerConnectorDefinition
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
  createIncident: true
id: f5130582-9e0e-cb47-af0b-dcd8b261fa04
severity: Low
subTechniques:
- T1498.001
status: Available
query: |
  Unifi_SiteManager_Sites_CL
        | where TimeGenerated > ago(1h)
  | extend txRetry = WifiTxRetryPct
        | where txRetry > 5.0
        | summarize arg_max(TimeGenerated, *) by SiteId, SiteName
        | extend Activity = strcat('TX retry rate ', round(txRetry, 1), '% (>5% threshold)')
        | project TimeGenerated, SiteId, SiteName, Activity, TxRetryPct = round(txRetry, 1)  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/UniFi Site Manager (CCF)/Analytic Rules/UniFiCloudWiFiqualitydegradedhighTXretry.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.1
name: 'UniFi Site Manager: WiFi quality degraded (high TX retry)'
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1498
description: |
    Identifies when the site-wide WiFi TX retry rate exceeds 5 percent, which may indicate RF interference, channel congestion, or active wireless attack.
triggerOperator: gt

ARM