↳ GitHub sourceAnalytics ruleHigh
UniFi Site Manager: System log shipping disabled
Description
Identifies when a UniFi host transitions cloudSystemLogState from enabled to disabled. This defense-evasion signal may indicate an attacker silencing audit trails.
- Rule type
- Scheduled
- Version
- 1.0.1
- Declared status
- Available
- Query frequency
- 15m
- Query period
- 45m
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
let prev = Unifi_SiteManager_Hosts_CL
| where TimeGenerated between (ago(30m) .. ago(15m))
| summarize arg_max(TimeGenerated, *) by Id
| project id_s = Id, prevState = tostring(ReportedState.cloudSystemLogState);
Unifi_SiteManager_Hosts_CL
| where TimeGenerated > ago(15m)
| summarize arg_max(TimeGenerated, *) by Id
| extend id_s = Id,
SiteName = tostring(ReportedState.name),
currentState = tostring(ReportedState.cloudSystemLogState)
| join kind=inner prev on id_s
| where currentState == 'disabled' and prevState == 'enabled'
| extend Activity = strcat('Cloud system log shipping was disabled on host ', SiteName, ' (', prevState, ' -> ', currentState, ')')
| project TimeGenerated, Id, SiteName, Activity, prevState, currentState
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
f32950bc-6553-4c03-2686-a9c29ef318e8
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC