UniFi Site Manager: ISP High Latency

Original query, unchanged.

// UniFi ISP High Latency Detection
let AvgLatencyThreshold = 200;
let MaxLatencyThreshold = 1000;
let SustainedPeriodCount = 2;
Unifi_SiteManager_ISPMetrics_CL
| where TimeGenerated > ago(30m)
| mv-expand period = Periods
| extend
    metricTime = todatetime(period.metricTime),
    avgLatency = toint(period.data.wan.avgLatency),
    maxLatency = toint(period.data.wan.maxLatency),
    ispName = tostring(period.data.wan.ispName),
    ispAsn = tostring(period.data.wan.ispAsn)
// De-duplicate Periods: each poll returns the same hour buckets, so collapse to latest value per metricTime
| summarize arg_max(TimeGenerated, avgLatency, maxLatency, ispAsn) by tostring(SiteId), ispName, metricTime
| where metricTime > ago(30m)
| where avgLatency > AvgLatencyThreshold or maxLatency > MaxLatencyThreshold
| summarize
    EventCount = count(),
    AvgLatency = avg(avgLatency),
    MaxLatency = max(maxLatency),
    FirstSeen = min(metricTime),
    LastSeen = max(metricTime)
    by SiteId, ispName, ispAsn
| where EventCount >= SustainedPeriodCount
| extend 
    TimeGenerated = now(),
    AvgLatencyRounded = round(AvgLatency, 1)
| project
    TimeGenerated,
    SiteId = SiteId,
    ISPName = ispName,
    ISPAsn = ispAsn,
    AvgLatencyMs = AvgLatencyRounded,
    MaxLatencyMs = MaxLatency,
    EventCount,
    FirstSeen,
    LastSeen