Tailscale_Audit_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Tables Index


Attribute Value
Ingestion API Supported ✓ Yes

Contents

Schema (13 columns)

Source: KQL validation test schema

Column Name Type
Action string
ActionDetails string
Actor dynamic
EventGroupID string
EventTime datetime
EventType string
New dynamic
Old dynamic
Origin dynamic
SourceSystem string
Target dynamic
TenantId string
TimeGenerated datetime

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Connectors (2)

This table is ingested by the following connectors:

Connector Selection Criteria
Tailscale Standard (CCF)
Tailscale Premium (CCF)

Content Items Using This Table (18)

Analytic Rules (11)

In solution Tailscale (CCF):

Analytic Rule Selection Criteria
Tailscale Premium: New posture integration added
Tailscale Premium: Posture integration disabled or removed
Tailscale: Auth key created
Tailscale: DNS nameservers modified
Tailscale: Exit node advertised or approved
Tailscale: MagicDNS disabled
Tailscale: Mass credential revocation in short window
Tailscale: New API access token or OAuth client created
Tailscale: OAuth client or API key created with write scopes
Tailscale: Policy file (ACL) modified
Tailscale: Split-DNS configuration modified

Hunting Queries (5)

In solution Tailscale (CCF):

Hunting Query Selection Criteria
Tailscale: ACL policy churn
Tailscale: Auth key sprawl
Tailscale: First-seen actor making configuration changes
Tailscale: Off-hours configuration changes
Tailscale: Split-DNS per-domain change history

Workbooks (2)

In solution Tailscale (CCF):

Workbook Selection Criteria
TailscalePremiumOperations
TailscaleStandardOperations

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Tables Index