New Tailscale CCF Solution: Zero-Trust Network Telemetry and Detection Coverage for Sentinel

Data Source

Tailscale REST API - a zero-trust mesh VPN platform managing device identity, tailnet access control, DNS, and (Premium/Enterprise) full network flow telemetry. Previously unmonitored in Microsoft Sentinel without custom tooling.

Two CCF connectors match Tailscale plan tiers:

• Tailscale Standard (CCF) - 9 polling rules, 7 custom tables. Covers Personal (Free), Starter, and Premium tailnets.
• Tailscale Premium (CCF) - 11 polling rules, 9 custom tables. Adds network flow logs and posture integrations. Requires Premium or Enterprise plan.

Ingestion Mechanism

CCF-based (Codeless Connector Framework) - no Function App or container required. All 9-11 RestApiPoller connectors deploy behind a single Connect button using the multi-poller-per-card pattern (shared guidValue parameter; mirrors ProofPoint TAP pattern). Authentication requires OAuth2 client credentials - personal API tokens (tskey-api-…) silently return HTTP 200 with empty arrays on protected endpoints, hiding misconfiguration.

Custom tables via CCF to DCE to DCR transform:

The DCR transform for Tailscale_Network_CL promotes 17 columns out of nested srcNode/dstNodes/traffic arrays including IsRelayed (DERP relay fallback via 127.3.3.40 magic IP) so queries avoid dynamic JSON traversal.

Detection Surface Unlocked

Analytic Rules - Standard tier (16 rules)

Identity and Access (5): New OAuth client/API key creation, OAuth/API key created with write scopes (High - T1098), user role elevated to admin/owner (High - T1098), unauthorized device connected to control plane (High - T1078, T1133).

Configuration (3): ACL policy file modified (T1562), mass credential revocation in short window (High - T1070), external shared-in device added (T1133).

Devices (3): Device newly advertising subnet routes (T1021), Tailscale SSH newly enabled (T1021), device key expiring within 7 days.

Network and Exit (2): Exit node advertised or approved - 0.0.0.0/0 or ::/0 in AdvertisedRoutes/EnabledRoutes (T1090), tailnet lock validation failure (High - T1562, T1078).

DNS (3): Global nameserver modification (High - T1071, T1568), MagicDNS disabled (T1562), split-DNS configuration modified (High - T1071, T1568).

Analytic Rules - Premium tier (additional 8 rules, require Tailscale_Network_CL)

Hunting Queries (22 total: 12 Standard + 10 Premium)

Standard: First-seen actor performing privileged config changes, ACL policy churn rate, off-hours configuration changes, auth key sprawl and no-expiry keys, dormant devices (30+ days), devices on outdated client, orphaned users, subnet-router churn, external device onboarding, webhook tampering, key-rotation gaps.

Premium: Beaconing candidates, cross-tag flow matrix, DERP relay persistence, exit-node usage breakdown, new source-to-destination node pairs (first-seen east-west paths), off-hours network flows, posture inventory, tagged service fan-in, top talkers by volume, multi-device per user anomaly.

ASIM Coverage

Two ASIM NetworkSession parsers map Tailscale_Network_CL to ASIM NetworkSession v0.2.6 schema (Premium tier only):

• vimNetworkSessionTailscale - filtering parser
• ASimNetworkSessionTailscale - wrapper for schema-union queries

Existing ASIM-normalised Analytic Rules and Hunting Queries targeting imNetworkSession will automatically include Tailscale flow data once the Premium connector is deployed - no rule changes required.

Deployment Notes

• OAuth2 is mandatory. Personal API tokens silently return empty data on protected endpoints - operators using tskey-api-… credentials will receive no data without error.
• DNS endpoint consolidation: three Tailscale endpoints (/dns/nameservers, /dns/preferences, /dns/searchpaths) land into one Tailscale_Dns_CL table with a ConfigType discriminator. Premium uses a single unified DCR input stream to stay within Azure 10-dataFlow DCR limit.
• Snapshot tables write full current state each poll - use summarize arg_max(TimeGenerated, *) by key for point-in-time queries.

Affected Files

.gitignore
.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Audit_CL.json
.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Devices_CL.json
.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Dns_CL.json
.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Keys_CL.json
.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Network_CL.json
.script/tests/KqlvalidationsTests/CustomTables/Tailscale_PostureIntegrations_CL.json
.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Settings_CL.json
.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Users_CL.json
.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Webhooks_CL.json
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Logos/Tailscale.svg
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleAuthkeycreated.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceAdvertisingSubnetRoutes.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceKeyExpiringSoon.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceSshNewlyEnabled.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDnsNameserversModified.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleExitnodeadvertisedorapproved.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleExternalDeviceAdded.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleMagicDnsDisabled.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleMasscredentialrevocationinshortwindow.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleNewAPIaccesstokenorOAuthclientcreated.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleOAuthClientCreatedWithWriteScopes.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscalePolicyfileACLmodified.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscalePremiumBeaconingDetected.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscalePremiumDerpRelaySurge.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscalePremiumLargeOutboundTransfer.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscalePremiumMassFanOut.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscalePremiumNewPostureIntegration.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscalePremiumPostureIntegrationDisabled.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscalePremiumSubnetRouterThroughputAnomaly.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscalePremiumUnexpectedExitNodeEgress.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleSplitDnsModified.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleTailnetLockValidationFailed.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleUnauthorizedDeviceConnected.yaml
Solutions/Tailscale (CCF)/Analytic Rules/TailscaleUserRoleElevated.yaml
Solutions/Tailscale (CCF)/Data Connectors/TailscaleAuditLogs_ccf/Tailscale_ConnectorDefinition.json
Solutions/Tailscale (CCF)/Data Connectors/TailscaleAuditLogs_ccf/Tailscale_DCR.json
Solutions/Tailscale (CCF)/Data Connectors/TailscaleAuditLogs_ccf/Tailscale_PollerConfig.json
Solutions/Tailscale (CCF)/Data Connectors/TailscaleAuditLogs_ccf/Tailscale_tables.json
Solutions/Tailscale (CCF)/Data Connectors/TailscalePremium_ccf/TailscalePremium_ConnectorDefinition.json
Solutions/Tailscale (CCF)/Data Connectors/TailscalePremium_ccf/TailscalePremium_DCR.json
Solutions/Tailscale (CCF)/Data Connectors/TailscalePremium_ccf/TailscalePremium_PollerConfig.json
Solutions/Tailscale (CCF)/Data Connectors/TailscalePremium_ccf/TailscalePremium_tables.json
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleACLPolicyChurn.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleAuthKeySprawl.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleAuthKeysNoExpiry.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleDevicesWithSshEnabled.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleDormantDevices.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleExternalDeviceInventory.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleFirstSeenActor.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleOffHoursConfigChanges.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleOrphanedUsers.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleOutdatedClients.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumBeaconingCandidates.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumCrossTagFlowMatrix.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumDerpRelayPersistence.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumExitNodeUsage.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumNewNodePairs.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumOffHoursFlows.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumPostureInventory.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumTaggedServiceFanIn.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumTopTalkers.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscalePremiumUserMultiDevice.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleSplitDnsPerDomainChanges.yaml
Solutions/Tailscale (CCF)/Hunting Queries/TailscaleSubnetRouteExposure.yaml
Solutions/Tailscale (CCF)/PREMIUM-ENDPOINTS.md
Solutions/Tailscale (CCF)/Package/testParameters.json
Solutions/Tailscale (CCF)/Parsers/ASimNetworkSessionTailscale.yaml
Solutions/Tailscale (CCF)/Parsers/vimNetworkSessionTailscale.yaml
Solutions/Tailscale (CCF)/README.md
Solutions/Tailscale (CCF)/Workbooks/TailscalePremiumOperations.json
Solutions/Tailscale (CCF)/Workbooks/TailscaleStandardOperations.json
Workbooks/WorkbooksMetadata.json
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_Tailscale.json, createUiDefinition.json, mainTemplate.json)