↳ GitHub sourceAnalytics ruleMedium

UniFi Site Manager: Data Connector Health

Description

Identifies when UniFi Site Manager data connectors stop sending data, ensuring visibility into the UniFi estate is maintained.
Rule type
Scheduled
Version
1.0.0
Declared status
Available
Query frequency
15m
Query period
2h
Trigger
gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

Data types

KQL query

Original query, unchanged.

// UniFi Data Connector Health Monitoring
let StaleThreshold = 30;
let DevicesHealth = Unifi_SiteManager_Devices_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Devices_CL", TableDisplay = "Devices";
let HostsHealth = Unifi_SiteManager_Hosts_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Hosts_CL", TableDisplay = "Hosts";
let SitesHealth = Unifi_SiteManager_Sites_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Sites_CL", TableDisplay = "Sites";
let ISPHealth = Unifi_SiteManager_ISPMetrics_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_ISPMetrics_CL", TableDisplay = "ISP Metrics";
union DevicesHealth, HostsHealth, SitesHealth, ISPHealth
| extend 
    MinutesSinceData = datetime_diff('minute', now(), LastReceived),
    Status = case(
        datetime_diff('minute', now(), LastReceived) <= 15, "Healthy",
        datetime_diff('minute', now(), LastReceived) <= 30, "Delayed",
        datetime_diff('minute', now(), LastReceived) <= 60, "Stale",
        "Critical"
    )
| where MinutesSinceData >= StaleThreshold
| extend TimeGenerated = now()
| project
    TimeGenerated,
    TableName,
    TableDisplay,
    LastReceived,
    MinutesSinceData,
    Status

Declared entities

CloudApplication

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
1fb5c195-9bff-e18b-3e8f-5123f46bff9d
Additional source files 2Solutions/UniFi Site Manager (CCF)/Analytic Rules/UniFiCloudDataConnectorHealth.yamlsource ↗Solutions/UniFi Site Manager (CCF)/Data/Solution_UnifiSiteManager.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.