Tailscale: Unauthorized device connected to control plane

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies devices actively connected to the Tailscale control plane (ConnectedToControl=true) but not yet authorized by an admin (Authorized=false). Often benign onboarding but can indicate rogue joins.

Attribute	Value
Type	Analytic Rule
Solution	Tailscale (CCF)
ID	a1b2c3d4-5678-9012-3456-789012340042
Severity	High
Status	Available
Kind	Scheduled
Tactics	InitialAccess, Persistence
Techniques	T1078, T1098
Required Connectors	TailscaleCCF
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
Tailscale_Devices_CL	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Tailscale (CCF)