Microsoft Sentinel medium experimental kql

Tailscale: New API access token or OAuth client created

Identifies when a new API access token or OAuth client is created in the tailnet. These grant programmatic access - verify the actor and intent.

View Source

Detection Logic

Tailscale_Audit_CL
| where Action == "CREATE"
| where tostring(Target.type) in ("API_KEY", "OAUTH_CLIENT")
| extend ActorLogin = tostring(Actor.loginName)
| extend TargetName = tostring(Target.name)
| extend TargetId = tostring(Target.id)
| project TimeGenerated, ActorLogin, Action, TargetName, TargetId, Origin, New

Field Validations

Loading…

Comments (0)

Loading comments...