↳ GitHub sourceAnalytics ruleHigh

UniFi Site Manager: Site Health Critical

Description

Identifies when a site has multiple offline devices, indicating significant site-level issues such as a power outage, network failure, or infrastructure problem.

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 15m
Query period: 30m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

UniFiSiteManagerConnectorDefinition

Data types

Unifi_SiteManager_Sites_CL

KQL query

Original query, unchanged.

// UniFi Site Health Critical Detection
let OfflineThreshold = 3;
Unifi_SiteManager_Sites_CL
| where TimeGenerated > ago(30m)
| summarize arg_max(TimeGenerated, *) by SiteId
| where OfflineDevices >= OfflineThreshold
| extend
    AvailabilityPct = round(100.0 * (TotalDevices - OfflineDevices) / TotalDevices, 1),
    TotalClients = WifiClients + WiredClients
| project
    TimeGenerated,
    SiteId = SiteId,
    SiteName = SiteName,
    TotalDevices = TotalDevices,
    OfflineDevices = OfflineDevices,
    OnlineDevices = TotalDevices - OfflineDevices,
    AvailabilityPct,
    TotalClients,
    WiFiClients = WifiClients,
    WiredClients = WiredClients,
    Timezone = Timezone

Declared entities

Host

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/UniFi Site Manager (CCF)/Analytic Rules/UniFiCloudSiteHealthCritical.yaml ↗
Commit: 9800e51 ↗
Source identifier: c8875ebb-cc6e-14e4-4216-d8b06fd92c90

Additional source files 2

Solutions/UniFi Site Manager (CCF)/Analytic Rules/UniFiCloudSiteHealthCritical.yamlsource ↗Solutions/UniFi Site Manager (CCF)/Data/Solution_UnifiSiteManager.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.