Tailscale Premium: Users generating traffic from multiple devices

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies users (SrcUser) generating tailnet flows from more than one distinct device in the past 24 hours. Useful for spotting account compromise (sudden new device) or unauthorised device enrollment.

Attribute	Value
Type	Hunting Query
Solution	Tailscale (CCF)
ID	daac10bd-d842-4122-90cc-9957256f04e3
Tactics	InitialAccess, Persistence
Techniques	T1078
Required Connectors	TailscalePremiumCCF
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
Tailscale_Devices_CL	?	✓	?
Tailscale_Network_CL	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Tailscale (CCF)