Microsoft Sentinel medium experimental kql

UniFi Site Manager: Data Connector Health

Identifies when UniFi Site Manager data connectors stop sending data, ensuring visibility into the UniFi estate is maintained.

View Source

Detection Logic

// UniFi Data Connector Health Monitoring
let StaleThreshold = 30;
let DevicesHealth = Unifi_SiteManager_Devices_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Devices_CL", TableDisplay = "Devices";
let HostsHealth = Unifi_SiteManager_Hosts_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Hosts_CL", TableDisplay = "Hosts";
let SitesHealth = Unifi_SiteManager_Sites_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_Sites_CL", TableDisplay = "Sites";
let ISPHealth = Unifi_SiteManager_ISPMetrics_CL
| where TimeGenerated > ago(2h)
| summarize LastReceived = max(TimeGenerated)
| extend TableName = "Unifi_SiteManager_ISPMetrics_CL", TableDisplay = "ISP Metrics";
union DevicesHealth, HostsHealth, SitesHealth, ISPHealth
| extend 
    MinutesSinceData = datetime_diff('minute', now(), LastReceived),
    Status = case(
        datetime_diff('minute', now(), LastReceived) <= 15, "Healthy",
        datetime_diff('minute', now(), LastReceived) <= 30, "Delayed",
        datetime_diff('minute', now(), LastReceived) <= 60, "Stale",
        "Critical"
    )
| where MinutesSinceData >= StaleThreshold
| extend TimeGenerated = now()
| project
    TimeGenerated,
    TableName,
    TableDisplay,
    LastReceived,
    MinutesSinceData,
    Status

Field Validations

Loading…

Comments (0)

Loading comments...