{
  "Name": "Tailscale (CCF)",
  "Author": "noodlemctwoodle - ccfconnectors.county118@passmail.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Tailscale.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [Tailscale](https://tailscale.com/) solution for Microsoft Sentinel ingests Tailscale identity, device, configuration, audit and (Premium) network-flow telemetry via OAuth2-secured APIs. Built on the Codeless Connector Framework (CCF) - no Function App or container required.\n\n**Data connectors in this solution (install the one matching your Tailscale plan):**\n- **Tailscale Standard (CCF)** - Configuration audit, devices, users, keys, webhooks, DNS, settings. Use on **Personal (Free), Starter and Premium** tailnets.\n- **Tailscale Premium (CCF)** - Everything in Standard plus network flow logs and posture integrations. Use on **Premium and Enterprise** tailnets for full coverage.\n\n**Pre-requisites:**\n1. Sign in to [Tailscale OAuth settings](https://login.tailscale.com/admin/settings/oauth)\n2. Create an OAuth client with the scopes for your tier (see the README in this solution).\n3. Copy the client ID and client secret (secret shown once).\n4. Note your tailnet name (e.g. `tailb094d7.ts.net`) from the [Keys page](https://login.tailscale.com/admin/settings/keys).",
  "BasePath": "C:\\GitHub\\azure-Sentinel\\Solutions\\Tailscale (CCF)",
  "Version": "3.0.0",
  "TemplateSpec": false,
  "Is1PConnector": false,
  "Data Connectors": [
    "Data Connectors/TailscaleAuditLogs_ccf/Tailscale_ConnectorDefinition.json",
    "Data Connectors/TailscalePremium_ccf/TailscalePremium_ConnectorDefinition.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/TailscaleNewAPIaccesstokenorOAuthclientcreated.yaml",
    "Analytic Rules/TailscaleOAuthClientCreatedWithWriteScopes.yaml",
    "Analytic Rules/TailscalePolicyfileACLmodified.yaml",
    "Analytic Rules/TailscaleAuthkeycreated.yaml",
    "Analytic Rules/TailscaleExitnodeadvertisedorapproved.yaml",
    "Analytic Rules/TailscaleMasscredentialrevocationinshortwindow.yaml",
    "Analytic Rules/TailscaleDeviceKeyExpiringSoon.yaml",
    "Analytic Rules/TailscaleDeviceAdvertisingSubnetRoutes.yaml",
    "Analytic Rules/TailscaleUserRoleElevated.yaml",
    "Analytic Rules/TailscaleSplitDnsModified.yaml",
    "Analytic Rules/TailscaleDnsNameserversModified.yaml",
    "Analytic Rules/TailscaleMagicDnsDisabled.yaml",
    "Analytic Rules/TailscaleTailnetLockValidationFailed.yaml",
    "Analytic Rules/TailscaleDeviceSshNewlyEnabled.yaml",
    "Analytic Rules/TailscaleUnauthorizedDeviceConnected.yaml",
    "Analytic Rules/TailscaleExternalDeviceAdded.yaml",
    "Analytic Rules/TailscalePremiumUnexpectedExitNodeEgress.yaml",
    "Analytic Rules/TailscalePremiumLargeOutboundTransfer.yaml",
    "Analytic Rules/TailscalePremiumBeaconingDetected.yaml",
    "Analytic Rules/TailscalePremiumMassFanOut.yaml",
    "Analytic Rules/TailscalePremiumSubnetRouterThroughputAnomaly.yaml",
    "Analytic Rules/TailscalePremiumPostureIntegrationDisabled.yaml",
    "Analytic Rules/TailscalePremiumNewPostureIntegration.yaml",
    "Analytic Rules/TailscalePremiumDerpRelaySurge.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/TailscaleFirstSeenActor.yaml",
    "Hunting Queries/TailscaleACLPolicyChurn.yaml",
    "Hunting Queries/TailscaleOffHoursConfigChanges.yaml",
    "Hunting Queries/TailscaleAuthKeySprawl.yaml",
    "Hunting Queries/TailscaleDormantDevices.yaml",
    "Hunting Queries/TailscaleAuthKeysNoExpiry.yaml",
    "Hunting Queries/TailscaleOrphanedUsers.yaml",
    "Hunting Queries/TailscaleSplitDnsPerDomainChanges.yaml",
    "Hunting Queries/TailscaleDevicesWithSshEnabled.yaml",
    "Hunting Queries/TailscaleExternalDeviceInventory.yaml",
    "Hunting Queries/TailscaleOutdatedClients.yaml",
    "Hunting Queries/TailscaleSubnetRouteExposure.yaml",
    "Hunting Queries/TailscalePremiumNewNodePairs.yaml",
    "Hunting Queries/TailscalePremiumTopTalkers.yaml",
    "Hunting Queries/TailscalePremiumExitNodeUsage.yaml",
    "Hunting Queries/TailscalePremiumBeaconingCandidates.yaml",
    "Hunting Queries/TailscalePremiumPostureInventory.yaml",
    "Hunting Queries/TailscalePremiumDerpRelayPersistence.yaml",
    "Hunting Queries/TailscalePremiumTaggedServiceFanIn.yaml",
    "Hunting Queries/TailscalePremiumCrossTagFlowMatrix.yaml",
    "Hunting Queries/TailscalePremiumOffHoursFlows.yaml",
    "Hunting Queries/TailscalePremiumUserMultiDevice.yaml"
  ],
  "Workbooks": [
    "Workbooks/TailscaleStandardOperations.json",
    "Workbooks/TailscalePremiumOperations.json"
  ],
  "Parsers": [
    "Parsers/vimNetworkSessionTailscale.yaml",
    "Parsers/ASimNetworkSessionTailscale.yaml"
  ],
  "Metadata": "SolutionMetadata.json"
}