Skip to content

Commit e9d27ce

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request #14482 from noodlemctwoodle/add-tailscale-ccf-solution
Add tailscale ccf solution
2 parents 348b961 + f25fcc9 commit e9d27ce

80 files changed

Lines changed: 21334 additions & 153 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,3 +355,6 @@ Hunting Queries/DeployedQueries.json
355355

356356
.arm-ttk
357357

358+
359+
# Local-only helper scripts (not for upstream submission)
360+
.local-helpers/

‎.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Audit_CL.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{ "Name": "Tailscale_Audit_CL",
2+
"Properties":[
3+
{ "Name": "TenantId", "Type": "string" },
4+
{ "Name": "SourceSystem", "Type": "string" },
5+
{ "Name": "TimeGenerated", "Type": "datetime" },
6+
{ "Name": "EventTime", "Type": "datetime" },
7+
{ "Name": "EventGroupID", "Type": "string" },
8+
{ "Name": "EventType", "Type": "string" },
9+
{ "Name": "ActionDetails", "Type": "string" },
10+
{ "Name": "Actor", "Type": "dynamic" },
11+
{ "Name": "Action", "Type": "string" },
12+
{ "Name": "Target", "Type": "dynamic" },
13+
{ "Name": "Origin", "Type": "dynamic" },
14+
{ "Name": "New", "Type": "dynamic" },
15+
{ "Name": "Old", "Type": "dynamic" }
16+
]}

‎.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Devices_CL.json‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
{
2+
"Name": "Tailscale_Devices_CL",
3+
"Properties": [
4+
{
5+
"Name": "TenantId",
6+
"Type": "string"
7+
},
8+
{
9+
"Name": "SourceSystem",
10+
"Type": "string"
11+
},
12+
{
13+
"Name": "TimeGenerated",
14+
"Type": "datetime"
15+
},
16+
{
17+
"Name": "DeviceId",
18+
"Type": "string"
19+
},
20+
{
21+
"Name": "DeviceName",
22+
"Type": "string"
23+
},
24+
{
25+
"Name": "Hostname",
26+
"Type": "string"
27+
},
28+
{
29+
"Name": "User",
30+
"Type": "string"
31+
},
32+
{
33+
"Name": "Os",
34+
"Type": "string"
35+
},
36+
{
37+
"Name": "ClientVersion",
38+
"Type": "string"
39+
},
40+
{
41+
"Name": "UpdateAvailable",
42+
"Type": "bool"
43+
},
44+
{
45+
"Name": "Authorized",
46+
"Type": "bool"
47+
},
48+
{
49+
"Name": "IsExternal",
50+
"Type": "bool"
51+
},
52+
{
53+
"Name": "Created",
54+
"Type": "datetime"
55+
},
56+
{
57+
"Name": "LastSeen",
58+
"Type": "datetime"
59+
},
60+
{
61+
"Name": "Expires",
62+
"Type": "datetime"
63+
},
64+
{
65+
"Name": "KeyExpiryDisabled",
66+
"Type": "bool"
67+
},
68+
{
69+
"Name": "BlocksIncomingConnections",
70+
"Type": "bool"
71+
},
72+
{
73+
"Name": "Addresses",
74+
"Type": "dynamic"
75+
},
76+
{
77+
"Name": "Tags",
78+
"Type": "dynamic"
79+
},
80+
{
81+
"Name": "EnabledRoutes",
82+
"Type": "dynamic"
83+
},
84+
{
85+
"Name": "AdvertisedRoutes",
86+
"Type": "dynamic"
87+
},
88+
{
89+
"Name": "ClientConnectivity",
90+
"Type": "dynamic"
91+
},
92+
{
93+
"Name": "MachineKey",
94+
"Type": "string"
95+
},
96+
{
97+
"Name": "NodeKey",
98+
"Type": "string"
99+
},
100+
{
101+
"Name": "Distro",
102+
"Type": "string"
103+
},
104+
{
105+
"Name": "SshEnabled",
106+
"Type": "bool"
107+
},
108+
{
109+
"Name": "ConnectedToControl",
110+
"Type": "bool"
111+
},
112+
{
113+
"Name": "TailnetLockKey",
114+
"Type": "string"
115+
},
116+
{
117+
"Name": "TailnetLockError",
118+
"Type": "string"
119+
}
120+
]
121+
}

‎.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Dns_CL.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{ "Name": "Tailscale_Dns_CL",
2+
"Properties":[
3+
{ "Name": "TenantId", "Type": "string" },
4+
{ "Name": "SourceSystem", "Type": "string" },
5+
{ "Name": "TimeGenerated", "Type": "datetime" },
6+
{ "Name": "ConfigType", "Type": "string" },
7+
{ "Name": "Nameservers", "Type": "dynamic" },
8+
{ "Name": "MagicDNS", "Type": "bool" },
9+
{ "Name": "SearchPaths", "Type": "dynamic" }
10+
]}

‎.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Keys_CL.json‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"Name": "Tailscale_Keys_CL",
3+
"Properties": [
4+
{
5+
"Name": "TenantId",
6+
"Type": "string"
7+
},
8+
{
9+
"Name": "SourceSystem",
10+
"Type": "string"
11+
},
12+
{
13+
"Name": "TimeGenerated",
14+
"Type": "datetime"
15+
},
16+
{
17+
"Name": "KeyId",
18+
"Type": "string"
19+
},
20+
{
21+
"Name": "Description",
22+
"Type": "string"
23+
},
24+
{
25+
"Name": "UserId",
26+
"Type": "string"
27+
},
28+
{
29+
"Name": "Created",
30+
"Type": "datetime"
31+
},
32+
{
33+
"Name": "Expires",
34+
"Type": "datetime"
35+
},
36+
{
37+
"Name": "Revoked",
38+
"Type": "datetime"
39+
},
40+
{
41+
"Name": "Capabilities",
42+
"Type": "dynamic"
43+
},
44+
{
45+
"Name": "KeyType",
46+
"Type": "string"
47+
},
48+
{
49+
"Name": "ExpirySeconds",
50+
"Type": "int"
51+
}
52+
]
53+
}

‎.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Network_CL.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{ "Name": "Tailscale_Network_CL",
2+
"Properties":[
3+
{ "Name": "TenantId", "Type": "string" },
4+
{ "Name": "SourceSystem", "Type": "string" },
5+
{ "Name": "TimeGenerated", "Type": "datetime" },
6+
{ "Name": "NodeId", "Type": "string" },
7+
{ "Name": "FlowStart", "Type": "datetime" },
8+
{ "Name": "FlowEnd", "Type": "datetime" },
9+
{ "Name": "SrcNode", "Type": "dynamic" },
10+
{ "Name": "SrcUser", "Type": "string" },
11+
{ "Name": "SrcNodeName", "Type": "string" },
12+
{ "Name": "SrcOs", "Type": "string" },
13+
{ "Name": "SrcTags", "Type": "dynamic" },
14+
{ "Name": "SrcAddresses", "Type": "dynamic" },
15+
{ "Name": "DstNodes", "Type": "dynamic" },
16+
{ "Name": "DstCount", "Type": "int" },
17+
{ "Name": "DstNodeId", "Type": "string" },
18+
{ "Name": "DstNodeName", "Type": "string" },
19+
{ "Name": "DstUser", "Type": "string" },
20+
{ "Name": "DstOs", "Type": "string" },
21+
{ "Name": "DstTags", "Type": "dynamic" },
22+
{ "Name": "DstAddresses", "Type": "dynamic" },
23+
{ "Name": "VirtualTraffic", "Type": "dynamic" },
24+
{ "Name": "SubnetTraffic", "Type": "dynamic" },
25+
{ "Name": "ExitTraffic", "Type": "dynamic" },
26+
{ "Name": "PhysicalTraffic", "Type": "dynamic" },
27+
{ "Name": "HasVirtualTraffic", "Type": "bool" },
28+
{ "Name": "HasSubnetTraffic", "Type": "bool" },
29+
{ "Name": "HasExitTraffic", "Type": "bool" },
30+
{ "Name": "HasPhysicalTraffic", "Type": "bool" },
31+
{ "Name": "IsRelayed", "Type": "bool" }
32+
]}

‎.script/tests/KqlvalidationsTests/CustomTables/Tailscale_PostureIntegrations_CL.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{ "Name": "Tailscale_PostureIntegrations_CL",
2+
"Properties":[
3+
{ "Name": "TenantId", "Type": "string" },
4+
{ "Name": "SourceSystem", "Type": "string" },
5+
{ "Name": "TimeGenerated", "Type": "datetime" },
6+
{ "Name": "IntegrationId", "Type": "string" },
7+
{ "Name": "Provider", "Type": "string" },
8+
{ "Name": "CloudId", "Type": "string" },
9+
{ "Name": "ClientId", "Type": "string" },
10+
{ "Name": "TenantId_Provider", "Type": "string" },
11+
{ "Name": "ConfigOverwrites", "Type": "dynamic" },
12+
{ "Name": "Status", "Type": "dynamic" }
13+
]}

‎.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Settings_CL.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{ "Name": "Tailscale_Settings_CL",
2+
"Properties":[
3+
{ "Name": "TenantId", "Type": "string" },
4+
{ "Name": "SourceSystem", "Type": "string" },
5+
{ "Name": "TimeGenerated", "Type": "datetime" },
6+
{ "Name": "DevicesApprovalOn", "Type": "bool" },
7+
{ "Name": "DevicesAutoUpdatesOn", "Type": "bool" },
8+
{ "Name": "DevicesKeyDurationDays", "Type": "int" },
9+
{ "Name": "UsersApprovalOn", "Type": "bool" },
10+
{ "Name": "UsersRoleAllowedToJoinExternalTailnets", "Type": "string" },
11+
{ "Name": "NetworkFlowLoggingOn", "Type": "bool" },
12+
{ "Name": "RegionalRoutingOn", "Type": "bool" },
13+
{ "Name": "PostureIdentityCollectionOn", "Type": "bool" }
14+
]}

‎.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Users_CL.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{ "Name": "Tailscale_Users_CL",
2+
"Properties":[
3+
{ "Name": "TenantId", "Type": "string" },
4+
{ "Name": "SourceSystem", "Type": "string" },
5+
{ "Name": "TimeGenerated", "Type": "datetime" },
6+
{ "Name": "UserId", "Type": "string" },
7+
{ "Name": "DisplayName", "Type": "string" },
8+
{ "Name": "LoginName", "Type": "string" },
9+
{ "Name": "TailnetId", "Type": "string" },
10+
{ "Name": "UserType", "Type": "string" },
11+
{ "Name": "Role", "Type": "string" },
12+
{ "Name": "Status", "Type": "string" },
13+
{ "Name": "DeviceCount", "Type": "int" },
14+
{ "Name": "Created", "Type": "datetime" },
15+
{ "Name": "LastSeen", "Type": "datetime" },
16+
{ "Name": "CurrentlyConnected", "Type": "bool" },
17+
{ "Name": "ProfilePicUrl", "Type": "string" }
18+
]}

‎.script/tests/KqlvalidationsTests/CustomTables/Tailscale_Webhooks_CL.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{ "Name": "Tailscale_Webhooks_CL",
2+
"Properties":[
3+
{ "Name": "TenantId", "Type": "string" },
4+
{ "Name": "SourceSystem", "Type": "string" },
5+
{ "Name": "TimeGenerated", "Type": "datetime" },
6+
{ "Name": "EndpointId", "Type": "string" },
7+
{ "Name": "EndpointUrl", "Type": "string" },
8+
{ "Name": "ProviderType", "Type": "string" },
9+
{ "Name": "CreatorLoginName", "Type": "string" },
10+
{ "Name": "Created", "Type": "datetime" },
11+
{ "Name": "LastModified", "Type": "datetime" },
12+
{ "Name": "Subscriptions", "Type": "dynamic" }
13+
]}

0 commit comments

Comments
 (0)