↳ GitHub sourceAnalytics ruleHigh

UniFi Site Manager: External WAN IP changed

Description

Identifies when a site reports more than one distinct WAN external IP within an hour, which may indicate ISP DHCP refresh, WAN reconfiguration, or routing hijack.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Reconnaissance T1590

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

UniFiSiteManagerConnectorDefinition

Data types

Unifi_SiteManager_Sites_CL

KQL query

Original query, unchanged.

Unifi_SiteManager_Sites_CL
      | where TimeGenerated > ago(1h)
      | extend SiteName = tostring(Meta.name),
               currentIp = tostring(SiteStatistics.wans.WAN.externalIp)
      | where isnotempty(currentIp)
      | summarize DistinctIps = make_set(currentIp), arg_max(TimeGenerated, currentIp) by SiteId, SiteName
      | where array_length(DistinctIps) > 1
      | extend Activity = strcat('WAN IP changed; observed: ', tostring(DistinctIps))
      | project TimeGenerated, SiteId, SiteName, Activity, CurrentIp = currentIp, ObservedIps = DistinctIps

Declared entities

IPHost

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/UniFi Site Manager (CCF)/Analytic Rules/UniFiCloudExternalWANIPchanged.yaml ↗
Commit: 9800e51 ↗
Source identifier: ef1a293a-9e2b-b087-7816-2610814ed2d4

Additional source files 2

Solutions/UniFi Site Manager (CCF)/Analytic Rules/UniFiCloudExternalWANIPchanged.yamlsource ↗Solutions/UniFi Site Manager (CCF)/Data/Solution_UnifiSiteManager.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.