Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies when a single src-dst pair transfers more than 100 MB over the tailnet within a 1-hour window. Large bursts can indicate data staging, exfiltration, or a misconfigured backup. Requires Tailscale Premium or Enterprise.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Tailscale (CCF) |
| ID | d2e3f4a5-2b3c-4d5e-6f7a-8b9c0d1e2f3a |
| Severity | Medium |
| Status | Available |
| Kind | Scheduled |
| Tactics | Exfiltration, Collection |
| Techniques | T1041, T1020 |
| Required Connectors | TailscalePremiumCCF |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
Tailscale_Network_CL |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊