Add tailscale ccf solution

.gitignore

@@ -355,3 +355,6 @@ Hunting Queries/DeployedQueries.json
 
 .arm-ttk
 
+
+# Local-only helper scripts (not for upstream submission)
+.local-helpers/

.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Audit_CL.json

@@ -0,0 +1,16 @@
+{ "Name": "Tailscale_Audit_CL",
+"Properties":[
+  { "Name": "TenantId", "Type": "string" },
+  { "Name": "SourceSystem", "Type": "string" },
+  { "Name": "TimeGenerated", "Type": "datetime" },
+  { "Name": "EventTime", "Type": "datetime" },
+  { "Name": "EventGroupID", "Type": "string" },
+  { "Name": "EventType", "Type": "string" },
+  { "Name": "ActionDetails", "Type": "string" },
+  { "Name": "Actor", "Type": "dynamic" },
+  { "Name": "Action", "Type": "string" },
+  { "Name": "Target", "Type": "dynamic" },
+  { "Name": "Origin", "Type": "dynamic" },
+  { "Name": "New", "Type": "dynamic" },
+  { "Name": "Old", "Type": "dynamic" }
+]}

.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Devices_CL.json

@@ -0,0 +1,121 @@
+{
+  "Name": "Tailscale_Devices_CL",
+  "Properties": [
+    {
+      "Name": "TenantId",
+      "Type": "string"
+    },
+    {
+      "Name": "SourceSystem",
+      "Type": "string"
+    },
+    {
+      "Name": "TimeGenerated",
+      "Type": "datetime"
+    },
+    {
+      "Name": "DeviceId",
+      "Type": "string"
+    },
+    {
+      "Name": "DeviceName",
+      "Type": "string"
+    },
+    {
+      "Name": "Hostname",
+      "Type": "string"
+    },
+    {
+      "Name": "User",
+      "Type": "string"
+    },
+    {
+      "Name": "Os",
+      "Type": "string"
+    },
+    {
+      "Name": "ClientVersion",
+      "Type": "string"
+    },
+    {
+      "Name": "UpdateAvailable",
+      "Type": "bool"
+    },
+    {
+      "Name": "Authorized",
+      "Type": "bool"
+    },
+    {
+      "Name": "IsExternal",
+      "Type": "bool"
+    },
+    {
+      "Name": "Created",
+      "Type": "datetime"
+    },
+    {
+      "Name": "LastSeen",
+      "Type": "datetime"
+    },
+    {
+      "Name": "Expires",
+      "Type": "datetime"
+    },
+    {
+      "Name": "KeyExpiryDisabled",
+      "Type": "bool"
+    },
+    {
+      "Name": "BlocksIncomingConnections",
+      "Type": "bool"
+    },
+    {
+      "Name": "Addresses",
+      "Type": "dynamic"
+    },
+    {
+      "Name": "Tags",
+      "Type": "dynamic"
+    },
+    {
+      "Name": "EnabledRoutes",
+      "Type": "dynamic"
+    },
+    {
+      "Name": "AdvertisedRoutes",
+      "Type": "dynamic"
+    },
+    {
+      "Name": "ClientConnectivity",
+      "Type": "dynamic"
+    },
+    {
+      "Name": "MachineKey",
+      "Type": "string"
+    },
+    {
+      "Name": "NodeKey",
+      "Type": "string"
+    },
+    {
+      "Name": "Distro",
+      "Type": "string"
+    },
+    {
+      "Name": "SshEnabled",
+      "Type": "bool"
+    },
+    {
+      "Name": "ConnectedToControl",
+      "Type": "bool"
+    },
+    {
+      "Name": "TailnetLockKey",
+      "Type": "string"
+    },
+    {
+      "Name": "TailnetLockError",
+      "Type": "string"
+    }
+  ]
+}

.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Dns_CL.json

@@ -0,0 +1,10 @@
+{ "Name": "Tailscale_Dns_CL",
+"Properties":[
+  { "Name": "TenantId", "Type": "string" },
+  { "Name": "SourceSystem", "Type": "string" },
+  { "Name": "TimeGenerated", "Type": "datetime" },
+  { "Name": "ConfigType", "Type": "string" },
+  { "Name": "Nameservers", "Type": "dynamic" },
+  { "Name": "MagicDNS", "Type": "bool" },
+  { "Name": "SearchPaths", "Type": "dynamic" }
+]}

.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Keys_CL.json

@@ -0,0 +1,53 @@
+{
+  "Name": "Tailscale_Keys_CL",
+  "Properties": [
+    {
+      "Name": "TenantId",
+      "Type": "string"
+    },
+    {
+      "Name": "SourceSystem",
+      "Type": "string"
+    },
+    {
+      "Name": "TimeGenerated",
+      "Type": "datetime"
+    },
+    {
+      "Name": "KeyId",
+      "Type": "string"
+    },
+    {
+      "Name": "Description",
+      "Type": "string"
+    },
+    {
+      "Name": "UserId",
+      "Type": "string"
+    },
+    {
+      "Name": "Created",
+      "Type": "datetime"
+    },
+    {
+      "Name": "Expires",
+      "Type": "datetime"
+    },
+    {
+      "Name": "Revoked",
+      "Type": "datetime"
+    },
+    {
+      "Name": "Capabilities",
+      "Type": "dynamic"
+    },
+    {
+      "Name": "KeyType",
+      "Type": "string"
+    },
+    {
+      "Name": "ExpirySeconds",
+      "Type": "int"
+    }
+  ]
+}

.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Network_CL.json

@@ -0,0 +1,32 @@
+{ "Name": "Tailscale_Network_CL",
+"Properties":[
+  { "Name": "TenantId", "Type": "string" },
+  { "Name": "SourceSystem", "Type": "string" },
+  { "Name": "TimeGenerated", "Type": "datetime" },
+  { "Name": "NodeId", "Type": "string" },
+  { "Name": "FlowStart", "Type": "datetime" },
+  { "Name": "FlowEnd", "Type": "datetime" },
+  { "Name": "SrcNode", "Type": "dynamic" },
+  { "Name": "SrcUser", "Type": "string" },
+  { "Name": "SrcNodeName", "Type": "string" },
+  { "Name": "SrcOs", "Type": "string" },
+  { "Name": "SrcTags", "Type": "dynamic" },
+  { "Name": "SrcAddresses", "Type": "dynamic" },
+  { "Name": "DstNodes", "Type": "dynamic" },
+  { "Name": "DstCount", "Type": "int" },
+  { "Name": "DstNodeId", "Type": "string" },
+  { "Name": "DstNodeName", "Type": "string" },
+  { "Name": "DstUser", "Type": "string" },
+  { "Name": "DstOs", "Type": "string" },
+  { "Name": "DstTags", "Type": "dynamic" },
+  { "Name": "DstAddresses", "Type": "dynamic" },
+  { "Name": "VirtualTraffic", "Type": "dynamic" },
+  { "Name": "SubnetTraffic", "Type": "dynamic" },
+  { "Name": "ExitTraffic", "Type": "dynamic" },
+  { "Name": "PhysicalTraffic", "Type": "dynamic" },
+  { "Name": "HasVirtualTraffic", "Type": "bool" },
+  { "Name": "HasSubnetTraffic", "Type": "bool" },
+  { "Name": "HasExitTraffic", "Type": "bool" },
+  { "Name": "HasPhysicalTraffic", "Type": "bool" },
+  { "Name": "IsRelayed", "Type": "bool" }
+]}

.script/tests/KqlvalidationsTests/CustomTables/Tailscale_PostureIntegrations_CL.json

@@ -0,0 +1,13 @@
+{ "Name": "Tailscale_PostureIntegrations_CL",
+"Properties":[
+  { "Name": "TenantId", "Type": "string" },
+  { "Name": "SourceSystem", "Type": "string" },
+  { "Name": "TimeGenerated", "Type": "datetime" },
+  { "Name": "IntegrationId", "Type": "string" },
+  { "Name": "Provider", "Type": "string" },
+  { "Name": "CloudId", "Type": "string" },
+  { "Name": "ClientId", "Type": "string" },
+  { "Name": "TenantId_Provider", "Type": "string" },
+  { "Name": "ConfigOverwrites", "Type": "dynamic" },
+  { "Name": "Status", "Type": "dynamic" }
+]}

.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Settings_CL.json

@@ -0,0 +1,14 @@
+{ "Name": "Tailscale_Settings_CL",
+"Properties":[
+  { "Name": "TenantId", "Type": "string" },
+  { "Name": "SourceSystem", "Type": "string" },
+  { "Name": "TimeGenerated", "Type": "datetime" },
+  { "Name": "DevicesApprovalOn", "Type": "bool" },
+  { "Name": "DevicesAutoUpdatesOn", "Type": "bool" },
+  { "Name": "DevicesKeyDurationDays", "Type": "int" },
+  { "Name": "UsersApprovalOn", "Type": "bool" },
+  { "Name": "UsersRoleAllowedToJoinExternalTailnets", "Type": "string" },
+  { "Name": "NetworkFlowLoggingOn", "Type": "bool" },
+  { "Name": "RegionalRoutingOn", "Type": "bool" },
+  { "Name": "PostureIdentityCollectionOn", "Type": "bool" }
+]}

.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Users_CL.json

@@ -0,0 +1,18 @@
+{ "Name": "Tailscale_Users_CL",
+"Properties":[
+  { "Name": "TenantId", "Type": "string" },
+  { "Name": "SourceSystem", "Type": "string" },
+  { "Name": "TimeGenerated", "Type": "datetime" },
+  { "Name": "UserId", "Type": "string" },
+  { "Name": "DisplayName", "Type": "string" },
+  { "Name": "LoginName", "Type": "string" },
+  { "Name": "TailnetId", "Type": "string" },
+  { "Name": "UserType", "Type": "string" },
+  { "Name": "Role", "Type": "string" },
+  { "Name": "Status", "Type": "string" },
+  { "Name": "DeviceCount", "Type": "int" },
+  { "Name": "Created", "Type": "datetime" },
+  { "Name": "LastSeen", "Type": "datetime" },
+  { "Name": "CurrentlyConnected", "Type": "bool" },
+  { "Name": "ProfilePicUrl", "Type": "string" }
+]}

.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Webhooks_CL.json

@@ -0,0 +1,13 @@
+{ "Name": "Tailscale_Webhooks_CL",
+"Properties":[
+  { "Name": "TenantId", "Type": "string" },
+  { "Name": "SourceSystem", "Type": "string" },
+  { "Name": "TimeGenerated", "Type": "datetime" },
+  { "Name": "EndpointId", "Type": "string" },
+  { "Name": "EndpointUrl", "Type": "string" },
+  { "Name": "ProviderType", "Type": "string" },
+  { "Name": "CreatorLoginName", "Type": "string" },
+  { "Name": "Created", "Type": "datetime" },
+  { "Name": "LastModified", "Type": "datetime" },
+  { "Name": "Subscriptions", "Type": "dynamic" }
+]}

.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

@@ -314,5 +314,6 @@
   "UniFiSiteManagerConnectorDefinition",
   "UtimacoESKMConnector",
   "GSDetectionAlerts",
-  "VaikoraSecurityCenter"
+  "TailscaleCCF",
+  "TailscalePremiumCCF"
 ]

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleAuthkeycreated.yaml

@@ -0,0 +1,42 @@
+id: 6b052c8d-5de8-eab0-1956-69a297765a32
+name: "Tailscale: Auth key created"
+description: |
+  Identifies when a new Tailscale auth key is generated. Auth keys allow unattended device enrollment into the tailnet - confirm it was expected and revoke if not.
+severity: Low
+status: Available
+requiredDataConnectors:
+  - connectorId: TailscaleCCF
+    dataTypes:
+      - Tailscale_Audit_CL
+queryFrequency: 15m
+queryPeriod: 15m
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - Persistence
+relevantTechniques:
+  - T1098
+query: |
+  Tailscale_Audit_CL
+        | where Action == "CREATE"
+        | where tostring(Target.type) == "AUTH_KEY"
+        | extend ActorLogin = tostring(Actor.loginName)
+        | extend KeyDescription = tostring(New.description)
+        | extend Reusable = tostring(New.reusable)
+        | extend Ephemeral = tostring(New.ephemeral)
+        | project TimeGenerated, ActorLogin, KeyDescription, Reusable, Ephemeral, Origin, New
+entityMappings:
+  - entityType: Account
+    fieldMappings:
+      - identifier: FullName
+        columnName: ActorLogin
+incidentConfiguration:
+  createIncident: true
+  groupingConfiguration:
+    enabled: true
+    reopenClosedIncident: false
+    lookbackDuration: 5h
+    matchingMethod: AllEntities
+    groupByEntities: []
+kind: Scheduled
+version: 1.0.0