Tailscale Premium: Posture integration disabled or removed

Status: available
Severity: high
Time window: 15m
Source: github.com/Azure/Azure-Sentinel

Identifies when a device-posture integration is disabled or removed from the tailnet. Posture integrations enforce device compliance - removal weakens fleet posture and is a possible defense-evasion step.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556` Modify Authentication Process
Defense Impairment	`T1685` Disable or Modify Tools

Rule body

id: a1b2c3d4-5678-9012-34ab-cdef12345030
name: "Tailscale Premium: Posture integration disabled or removed"
description: Identifies when a device-posture integration is disabled or removed from the tailnet. Posture integrations enforce device compliance - removal weakens fleet posture and is a possible defense-evasion step.
description-detailed: |
  Identifies when a device-posture integration is disabled or removed from the tailnet. Posture integrations enforce device compliance; removing one disables that enforcement and increases blast radius for compromised endpoints. Requires Tailscale Premium or Enterprise.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: TailscalePremiumCCF
    dataTypes:
      - Tailscale_Audit_CL
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
  - Persistence
relevantTechniques:
  - T1562
  - T1556
query: |
  Tailscale_Audit_CL
  | where Action in ("DELETE", "UPDATE")
  | where tostring(Target.type) == "POSTURE_INTEGRATION"
    or tostring(Target.type) startswith "POSTURE"
  | extend ActorLogin = tostring(Actor.loginName)
  | extend Provider = tostring(Target.name)
  | project TimeGenerated, ActorLogin, Action, Provider, Target, Old, New, Origin
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorLogin
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.0

Stages and Predicates

Stage 1: `source`

Tailscale_Audit_CL

Stage 2: `where`

| where Action in ("DELETE", "UPDATE")

Stage 3: `where`

| where tostring(Target.type) == "POSTURE_INTEGRATION"
  or tostring(Target.type) startswith "POSTURE"

Stage 4: `extend`

| extend ActorLogin = tostring(Actor.loginName)

Stage 5: `extend`

| extend Provider = tostring(Target.name)

Stage 6: `project`

| project TimeGenerated, ActorLogin, Action, Provider, Target, Old, New, Origin

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	in	`DELETE` `UPDATE`	`field:"Action" kind:in`
`type`	eq	`POSTURE_INTEGRATION` transforms: `tostring`	`field:"type" kind:eq value:"POSTURE_INTEGRATION"`
`type`	starts_with	`POSTURE` transforms: `tostring`	`field:"type" kind:starts_with value:"POSTURE"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Action`	`project`
`ActorLogin`	`project`
`New`	`project`
`Old`	`project`
`Origin`	`project`
`Provider`	`project`
`Target`	`project`
`TimeGenerated`	`project`

Tailscale Premium: Posture integration disabled or removed

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: extend

Stage 6: project