Microsoft Sentinel high experimental kql

Tailscale Premium: Posture integration disabled or removed

Identifies when a device-posture integration is disabled or removed from the tailnet. Posture integrations enforce device compliance - removal weakens fleet posture and is a possible defense-evasion step.

View Source

Detection Logic

Tailscale_Audit_CL
| where Action in ("DELETE", "UPDATE")
| where tostring(Target.type) == "POSTURE_INTEGRATION"
  or tostring(Target.type) startswith "POSTURE"
| extend ActorLogin = tostring(Actor.loginName)
| extend Provider = tostring(Target.name)
| project TimeGenerated, ActorLogin, Action, Provider, Target, Old, New, Origin

Field Validations

Loading…

Comments (0)

Loading comments...