↳ GitHub sourceAnalytics ruleHigh
UniFi Site Manager: Multiple Devices Offline
Description
Identifies when multiple UniFi devices go offline simultaneously, typically signaling a power outage, upstream connectivity failure, or infrastructure issue requiring investigation.
- Rule type
- Scheduled
- Version
- 1.0.3
- Declared status
- Available
- Query frequency
- 15m
- Query period
- 30m
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
let prev_offline_ids = Unifi_SiteManager_Devices_CL
| where TimeGenerated between (ago(45m) .. ago(15m))
| summarize arg_max(TimeGenerated, *) by Id
| where Status == "offline"
| distinct Id;
Unifi_SiteManager_Devices_CL
| where TimeGenerated > ago(15m)
| summarize arg_max(TimeGenerated, *) by Id
| where Status == "offline"
| extend IsNew = Id !in (prev_offline_ids)
| summarize
OfflineDeviceCount = count(),
NewlyOfflineCount = countif(IsNew),
OfflineDevices = make_list(coalesce(Name, Id)),
NewlyOfflineDevices = make_list_if(coalesce(Name, Id), IsNew),
ProductLines = make_set(ProductLine)
| where OfflineDeviceCount >= 3
| where NewlyOfflineCount > 0
| extend
TimeGenerated = now(),
OfflineDeviceList = strcat_array(OfflineDevices, ", "),
NewlyOfflineList = strcat_array(NewlyOfflineDevices, ", "),
AffectedProductLines = strcat_array(ProductLines, ", ")
| extend Activity = strcat(NewlyOfflineCount, ' device(s) newly offline (', OfflineDeviceCount, ' total offline): ', NewlyOfflineList)
| project
TimeGenerated,
OfflineDeviceCount,
NewlyOfflineCount,
OfflineDeviceList,
NewlyOfflineList,
AffectedProductLines,
Activity
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
9283b576-5350-fca1-3979-dacb6acd1d16
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC