Detection rules › Kusto
Tailscale Premium: New posture integration added
Identifies when a new device-posture integration is added to the tailnet (Jamf, Kandji, Intune, Kolide, Defender for Endpoint, CrowdStrike, SentinelOne). Verify the addition was sanctioned.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Rule body
id: b2c3d4e5-6789-0123-45ab-cdef12345031
name: "Tailscale Premium: New posture integration added"
description: Identifies when a new device-posture integration is added to the tailnet (Jamf, Kandji, Intune, Kolide, Defender for Endpoint, CrowdStrike, SentinelOne). Verify the addition was sanctioned.
description-detailed: |
Identifies when a new device-posture integration is added to the tailnet (Jamf, Kandji, Intune, Kolide, Defender for Endpoint, CrowdStrike, SentinelOne, etc.). Unexpected additions may indicate an attacker establishing a control plane or bypassing compliance gates. Requires Tailscale Premium or Enterprise.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: TailscalePremiumCCF
dataTypes:
- Tailscale_Audit_CL
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
relevantTechniques:
- T1098
query: |
Tailscale_Audit_CL
| where Action == "CREATE"
| where tostring(Target.type) == "POSTURE_INTEGRATION"
or tostring(Target.type) startswith "POSTURE"
| extend ActorLogin = tostring(Actor.loginName)
| extend Provider = tostring(Target.name)
| project TimeGenerated, ActorLogin, Provider, Target, New, Origin
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: ActorLogin
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: P1D
matchingMethod: AllEntities
kind: Scheduled
version: 1.0.0
Stages and Predicates
Stage 1: source
Tailscale_Audit_CL
Stage 2: where
| where Action == "CREATE"
Stage 3: where
| where tostring(Target.type) == "POSTURE_INTEGRATION"
or tostring(Target.type) startswith "POSTURE"
Stage 4: extend
| extend ActorLogin = tostring(Actor.loginName)
Stage 5: extend
| extend Provider = tostring(Target.name)
Stage 6: project
| project TimeGenerated, ActorLogin, Provider, Target, New, Origin
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Action | eq |
| field:"Action" kind:eq value:"CREATE" |
type | eq |
| field:"type" kind:eq value:"POSTURE_INTEGRATION" |
type | starts_with |
| field:"type" kind:starts_with value:"POSTURE" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
ActorLogin | project |
New | project |
Origin | project |
Provider | project |
Target | project |
TimeGenerated | project |