Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies when a subnet router (gateway node bridging the tailnet to an on-prem or cloud subnet) handles 3x or more its 7-day baseline traffic in the last hour. Spikes can indicate exfiltration or scanning. Requires Tailscale Premium or Enterprise.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Tailscale (CCF) |
| ID | a5b6c7d8-5e6f-7a8b-9c0d-1e2f3a4b5c6d |
| Severity | Low |
| Status | Available |
| Kind | Scheduled |
| Tactics | Exfiltration, CommandAndControl |
| Techniques | T1572, T1041 |
| Required Connectors | TailscalePremiumCCF |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
Tailscale_Network_CL |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊