↳ GitHub sourceAnalytics ruleLow

Tailscale: Exit node advertised or approved

Description

Identifies when a device starts advertising itself as an exit node, or when an admin approves one. Validate the device and operator - rogue exit nodes can intercept tailnet egress.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 30m
Query period: 30m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

TailscaleCCF

Data types

Tailscale_Audit_CL

KQL query

Original query, unchanged.

Tailscale_Audit_CL
      | where Action contains "EXIT" or tostring(New.advertisedExitNode) == "true" or tostring(New.allowedExitNode) == "true"
      | extend ActorLogin = tostring(Actor.loginName)
      | extend NodeName = tostring(Target.name)
      | extend NodeId = tostring(Target.id)
      | project TimeGenerated, ActorLogin, Action, NodeName, NodeId, Origin, New, Old

Declared entities

AccountHost

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Tailscale (CCF)/Analytic Rules/TailscaleExitnodeadvertisedorapproved.yaml ↗
Commit: 9800e51 ↗
Source identifier: f42f2906-c8e6-23d0-e48c-0620e50d5510

Additional source files 2

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleExitnodeadvertisedorapproved.yamlsource ↗Solutions/Tailscale (CCF)/Data/Solution_Tailscale.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.