Panther rules: tailscale

from panther_tailscale_helpers import is_tailscale_admin_console_event, tailscale_alert_context


def rule(event):

    action = event.deep_get("event", "action", default="<NO_ACTION_FOUND>")
    target_property = event.deep_get(
        "event", "target", "property", default="<NO_TARGET_PROPERTY_FOUND>"
    )
    return all(
        [
            action == "DISABLE",
            target_property == "HTTPS",
            is_tailscale_admin_console_event(event),
        ]
    )


def title(event):
    user = event.deep_get("event", "actor", "loginName", default="<NO_USER_FOUND>")
    target_id = event.deep_get("event", "target", "id", default="<NO_TARGET_ID_FOUND>")
    return (
        f"Tailscale user [{user}] disabled HTTPS for "
        f"[{target_id}] in your organization’s tenant."
    )


def alert_context(event):
    return tailscale_alert_context(event)

AnalysisType: rule
Description: A Tailscale User disabled HTTPS settings in your organization's tenant.
DisplayName: "Tailscale HTTPS Disabled"
Enabled: true
Filename: tailscale_https_disabled.py
Runbook: Assess if this was done by the user for a valid business reason. Be vigilant to re-enable this setting as it's in the best security interest for your organization's security posture.
Reference: https://tailscale.com/kb/1153/enabling-https/#disable-https
Severity: High
DedupPeriodMinutes: 60
LogTypes:
  - Tailscale.Audit
RuleID: "Tailscale.HTTPS.Disabled"
Threshold: 1

from panther_tailscale_helpers import is_tailscale_admin_console_event, tailscale_alert_context


def rule(event):

    action = event.deep_get("event", "action", default="<NO_ACTION_FOUND>")
    target_property = event.deep_get(
        "event", "target", "property", default="<NO_TARGET_PROPERTY_FOUND>"
    )
    return all(
        [
            action == "DISABLE",
            target_property == "MACHINE_APPROVAL_NEEDED",
            is_tailscale_admin_console_event(event),
        ]
    )


def title(event):
    user = event.deep_get("event", "actor", "loginName", default="<NO_USER_FOUND>")
    return (
        f"Tailscale user [{user}] disabled device approval requirements "
        f"for new devices accessing your organization’s network."
    )


def alert_context(event):
    return tailscale_alert_context(event)

AnalysisType: rule
Description: A Tailscale User disabled machine approval requirement settings in your organization's tenant. This means devices can access your network without requiring approval.
DisplayName: "Tailscale Machine Approval Requirements Disabled"
Enabled: true
Filename: tailscale_machine_approval_requirements_disabled.py
Runbook: Assess if this was done by the user for a valid business reason. Be vigilant to re-enable this setting as it's in the best security interest for your organization's security posture.
Reference: https://tailscale.com/kb/1099/device-approval/
Severity: High
DedupPeriodMinutes: 60
LogTypes:
  - Tailscale.Audit
RuleID: "Tailscale.Machine.Approval.Requirements.Disabled"
Threshold: 1

from panther_tailscale_helpers import is_tailscale_admin_console_event, tailscale_alert_context


def rule(event):

    action = event.deep_get("event", "action", default="<NO_ACTION_FOUND>")
    target_property = event.deep_get(
        "event", "target", "property", default="<NO_TARGET_PROPERTY_FOUND>"
    )
    return all(
        [
            action == "DISABLE",
            target_property == "MAGIC_DNS",
            is_tailscale_admin_console_event(event),
        ]
    )


def title(event):
    user = event.deep_get("event", "actor", "loginName", default="<NO_USER_FOUND>")
    target_id = event.deep_get("event", "target", "id", default="<NO_TARGET_ID_FOUND>")
    return (
        f"Tailscale user [{user}] disabled Magic DNS for "
        f"[{target_id}] in your organization’s tenant."
    )


def alert_context(event):
    return tailscale_alert_context(event)

AnalysisType: rule
Description: A Tailscale User disabled magic dns settings in your organization's tenant.
DisplayName: "Tailscale Magic DNS Disabled"
Enabled: true
Filename: tailscale_magicdns_disabled.py
Runbook: Assess if this was done by the user for a valid business reason. Be vigilant to re-enable this setting as it's in the best security interest for your organization's security posture.
Reference: https://tailscale.com/kb/1081/magicdns/
Severity: High
DedupPeriodMinutes: 60
LogTypes:
  - Tailscale.Audit
RuleID: "Tailscale.Magic.DNS.Disabled"
Threshold: 1