Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies when Tailscale SSH is enabled on a device that previously did not have it. SSH provides authenticated shell access over the tailnet using Tailscale identity, broadening attack surface if unexpected. Verify and confirm the SSH ACL covers it.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Tailscale (CCF) |
| ID | f0a1b2c3-4567-8901-23de-f12345670041 |
| Severity | Medium |
| Status | Available |
| Kind | Scheduled |
| Tactics | Persistence, LateralMovement |
| Techniques | T1021, T1098 |
| Required Connectors | TailscaleCCF |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
Tailscale_Devices_CL |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊