UniFi Site Manager: ISP Packet Loss

Original query, unchanged.

// UniFi ISP Packet Loss Detection
let PacketLossThreshold = 5;
let MinTotalPacketLoss = 10;
Unifi_SiteManager_ISPMetrics_CL
| where TimeGenerated > ago(30m)
| mv-expand period = Periods
| extend
    metricTime = todatetime(period.metricTime),
    packetLoss = toint(period.data.wan.packetLoss),
    ispName = tostring(period.data.wan.ispName),
    ispAsn = tostring(period.data.wan.ispAsn),
    avgLatency = toint(period.data.wan.avgLatency)
// De-duplicate Periods: each poll returns the same hour buckets, so collapse to latest value per metricTime
| summarize arg_max(TimeGenerated, packetLoss, avgLatency, ispAsn) by tostring(SiteId), ispName, metricTime
| where metricTime > ago(30m)
| where packetLoss >= PacketLossThreshold
| summarize
    TotalPacketLoss = sum(packetLoss),
    EventCount = count(),
    AvgLatency = avg(avgLatency),
    FirstSeen = min(metricTime),
    LastSeen = max(metricTime)
    by SiteId, ispName, ispAsn
| where TotalPacketLoss >= MinTotalPacketLoss
| extend TimeGenerated = now()
| project
    TimeGenerated,
    SiteId = SiteId,
    ISPName = ispName,
    ISPAsn = ispAsn,
    TotalPacketLoss,
    EventCount,
    AvgLatencyMs = round(AvgLatency, 1),
    FirstSeen,
    LastSeen