Tailscale Premium: Unexpected exit-node egress

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies when a node sends traffic via an exit node not used in the prior 7-day baseline. First-seen exit destinations from a node may indicate routing-policy drift, data exfiltration, or compromise.

Attribute	Value
Type	Analytic Rule
Solution	Tailscale (CCF)
ID	c1d2e3f4-1a2b-3c4d-5e6f-7a8b9c0d1e2f
Severity	Medium
Status	Available
Kind	Scheduled
Tactics	CommandAndControl, Exfiltration
Techniques	T1090, T1041
Required Connectors	TailscalePremiumCCF
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
Tailscale_Network_CL	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Tailscale (CCF)