Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies when a single node initiates flows to 25 or more unique destinations within a 15-minute window. Sudden fan-out is consistent with port scanning, lateral discovery, or worm-style propagation. Requires Tailscale Premium or Enterprise.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Tailscale (CCF) |
| ID | f4a5b6c7-4d5e-6f7a-8b9c-0d1e2f3a4b5c |
| Severity | High |
| Status | Available |
| Kind | Scheduled |
| Tactics | Discovery, LateralMovement |
| Techniques | T1018, T1021, T1046 |
| Required Connectors | TailscalePremiumCCF |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
Tailscale_Network_CL |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊