Tailscale_Network_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

---

Attribute	Value
Ingestion API Supported	✓ Yes

Contents

• Schema
• Schema References
• Solutions
• Connectors
• Content Items
• Parsers

Schema (29 columns)

Source: KQL validation test schema

Column Name	Type
DstAddresses	dynamic
DstCount	int
DstNodeId	string
DstNodeName	string
DstNodes	dynamic
DstOs	string
DstTags	dynamic
DstUser	string
ExitTraffic	dynamic
FlowEnd	datetime
FlowStart	datetime
HasExitTraffic	bool
HasPhysicalTraffic	bool
HasSubnetTraffic	bool
HasVirtualTraffic	bool
IsRelayed	bool
NodeId	string
PhysicalTraffic	dynamic
SourceSystem	string
SrcAddresses	dynamic
SrcNode	dynamic
SrcNodeName	string
SrcOs	string
SrcTags	dynamic
SrcUser	string
SubnetTraffic	dynamic
TenantId	string
TimeGenerated	datetime
VirtualTraffic	dynamic

Schema References

Official Microsoft Learn documentation for field/column information:

• Data Source Schema Reference

Solutions (1)

This table is used by the following solutions:

• Tailscale (CCF)

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Tailscale Premium (CCF)

---

Content Items Using This Table (16)

Analytic Rules (6)

In solution Tailscale (CCF):

Analytic Rule	Selection Criteria
Tailscale Premium: DERP relay traffic surge
Tailscale Premium: Large outbound transfer over tailnet
Tailscale Premium: Mass fan-out from single node
Tailscale Premium: Network flow beaconing detected
Tailscale Premium: Subnet router throughput anomaly
Tailscale Premium: Unexpected exit-node egress

Hunting Queries (9)

In solution Tailscale (CCF):

Hunting Query	Selection Criteria
Tailscale Premium: Beaconing candidates (regular periodic flows)
Tailscale Premium: Cross-tag flow matrix
Tailscale Premium: Devices with persistent DERP relay usage
Tailscale Premium: Exit-node usage patterns
Tailscale Premium: Network flows outside business hours
Tailscale Premium: New src->dst node pairs (lateral movement candidates)
Tailscale Premium: Tagged services with broad inbound exposure
Tailscale Premium: Top talkers by bytes (virtual traffic)
Tailscale Premium: Users generating traffic from multiple devices

Workbooks (1)

In solution Tailscale (CCF):

Workbook	Selection Criteria
TailscalePremiumOperations

Parsers Using This Table (2)

Other Parsers (2)

Parser	Solution	Selection Criteria
ASimNetworkSessionTailscale	Tailscale (CCF)
vimNetworkSessionTailscale	Tailscale (CCF)

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index