Tailscale_Devices_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Tables Index


Attribute Value
Ingestion API Supported ✓ Yes

Contents

Schema (29 columns)

Source: KQL validation test schema

Column Name Type
Addresses dynamic
AdvertisedRoutes dynamic
Authorized bool
BlocksIncomingConnections bool
ClientConnectivity dynamic
ClientVersion string
ConnectedToControl bool
Created datetime
DeviceId string
DeviceName string
Distro string
EnabledRoutes dynamic
Expires datetime
Hostname string
IsExternal bool
KeyExpiryDisabled bool
LastSeen datetime
MachineKey string
NodeKey string
Os string
SourceSystem string
SshEnabled bool
Tags dynamic
TailnetLockError string
TailnetLockKey string
TenantId string
TimeGenerated datetime
UpdateAvailable bool
User string

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Connectors (2)

This table is ingested by the following connectors:

Connector Selection Criteria
Tailscale Standard (CCF)
Tailscale Premium (CCF)

Content Items Using This Table (14)

Analytic Rules (6)

In solution Tailscale (CCF):

Analytic Rule Selection Criteria
Tailscale: Device Tailscale SSH newly enabled
Tailscale: Device key expiring within 7 days
Tailscale: Device started advertising subnet routes
Tailscale: External (shared-in) device added
Tailscale: Tailnet lock validation failed
Tailscale: Unauthorized device connected to control plane

Hunting Queries (6)

In solution Tailscale (CCF):

Hunting Query Selection Criteria
Tailscale Premium: Users generating traffic from multiple devices
Tailscale: Devices not seen in 30+ days
Tailscale: Devices with Tailscale SSH enabled
Tailscale: Devices with outdated client version
Tailscale: External (shared-in) device inventory
Tailscale: Subnet router CIDR exposure inventory

Workbooks (2)

In solution Tailscale (CCF):

Workbook Selection Criteria
TailscalePremiumOperations
TailscaleStandardOperations

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Tables Index