Logs, audit trail & incident response — found from sitemap — Tailscale

Cited by

Facts read from this source

• Audit logging availability Report an error

  “Configuration audit logs are available for all plans.”

• Audit logging retention Report an error

  “Configuration audit logs are enabled by default for all tailnets, and are available for the most recent 90 days.”

• Audit logging can disable Report an error

  “Configuration audit logs are always enabled for all tailnets and cannot be disabled.”

• Audit logging content Report an error

  “Configuration audit logs record actions that modify a tailnet's configuration, including the type of action, the actor, the target resource, and the time.”

• Audit logging policy diff Report an error

  “For changes to the tailnet policy file, the log includes a full diff of the previous and new files.”

• Audit logging export Report an error

  “You can export logs for long-term storage and/or for security analysis, threat detection, and incident investigation.”

• Audit logging siem streaming Report an error

  “You can also stream logs to a security information and event management (SIEM) system.”

• Audit logs admin console Report an error

  “All users who have access to the admin console can find configuration audit logs in the Logs page of the admin console, and can filter these logs to find specific events.”

• Audit logs API Report an error

  “You can export configuration audit logs from the Tailscale API. You need an API access token with the logs:configuration:read scope to access configuration audit logs.”

• Audit logs API pagination Report an error

  “Currently, there is no pagination support and no maximum page size for the API. All events in the specified timeframe are returned.”

• Audit log revert Report an error

  “You can revert your tailnet policy file from a previous date and time.”

• Audit logging limitations Report an error

  “Configuration audit logs only include actions that modify a tailnet's configurations. Read-only actions, such as a user viewing the admin console, are not included.”

• Audit logging no data plane Report an error

  “Information about connections within a tailnet (data plane audit logs), such as network flow logs, are not included in configuration logs. You can use Network flow logs to log information about connections with a tailnet.”

• Audit logging failed logins Report an error

  “Note that failed login attempts are not included in Tailscale events—these should be seen in your identity provider logs, not Tailscale logs.”

• Audit logging support initiated Report an error

  “Changes to a tailnet that were initiated by a request to Tailscale's support team are currently not included.”

• Audit logging delay Report an error

  “There is currently no guarantee for a maximum delay between an event taking place and its inclusion in the audit logs. In practice, this occurs within seconds.”

• Audit logging storage configurable Report an error

  “The period of time that configuration logs are stored cannot be configured. Configuration logs are stored for 90 days.”

• Audit log events scope Report an error

  “Configuration audit logs include write actions that change the configuration of a tailnet, including changes that a user can make in the admin console or by using the Tailscale API.”

• Audit log targets Report an error

  “Events included in configuration audit logs are:”

• Audit log service events Report an error

  “The log includes service events, which are actions performed by the Tailscale service, not performed by users directly.”

• Audit log event grouping Report an error

  “When multiple events occur for a single operation, the actions have the same value for eventGroupID.”

• Audit log shared nodes Report an error

  “When using link-based node sharing, some events are logged in both the sharer and sharee tailnets.”

• Audit log node key dedup Report an error

  “Devices with the same node key will appear in logs as the same node target.”

Scores citing this record

• The DevOps Engineer Logs, audit trail & incident response
• The IT Lead Logs, audit trail & incident response
• The MSP Technician Logs, audit trail & incident response
• The Operations Manager Logs, audit trail & incident response
• The Information Security Officer Logs, audit trail & incident response
• The Skeptic Logs, audit trail & incident response