Logs, audit trail & incident response — found from sitemap — Tailscale

Cited by

Facts read from this source

• Plan availability Report an error

  “Log streaming is available for the Premium and Enterprise plans.”

• Log streaming purpose Report an error

  “Log streaming lets you collect and send configuration audit logs or network flow logs about your Tailscale network (known as a tailnet) into various systems for collection and analysis.”

• Traffic user agent Report an error

  “You can use User-Agent: TailscaleLogStreamPublisher to identify Tailscale traffic.”

• Siem systems Report an error

  “We support log streaming integrations for the following SIEM systems: Axiom Cribl Datadog Elasticsearch Logstash, through a data stream Panther Splunk, through an HTTP Event Collector”

• Other types Report an error

  “Additional integrations that you can use for log streaming include: Private endpoints Vector”

• Roles for streaming destinations Report an error

  “You need to be an Owner, Admin, Network admin, or IT admin to add, edit, and delete a streaming destination.”

• Endpoint https requirement Report an error

  “The endpoint URL must use the HTTPS protocol, and there is no restriction on which port is used.”

• Private endpoint http allowed Report an error

  “Alternatively, log streaming can publish logs to a private host that is not directly reachable over the public internet by using Tailscale for connectivity. Plain HTTP may be used since the underlying transport is secured by Tailscale using WireGuard.”

• Private endpoint ipv6 only Report an error

  “Only IPv6 addresses are supported for log streaming. IPv4 addresses are not supported for log streaming because Tailscale uses CGNAT for IPv4 addresses assigned to nodes within a single tailnet.”

• Private endpoint roles Report an error

  “only the Admin and Network admin roles have sufficient permissions to unilaterally make use of private endpoints. The IT admin has the ability to share nodes, but lacks the ability to update the tailnet policy file.”

• Gitops private endpoint limitation Report an error

  “If your tailnet is configured to use GitOps for management of Tailscale, you will receive an error when Tailscale attempts to update your tailnet policy file to support incoming traffic from the logstream@tailscale user.”

• Splunk hec compatible Report an error

  “Some SIEM systems have Splunk HTTP Event Collector (Splunk HEC) compatible endpoints such as DataSet by SentinelOne. If your SIEM supports Splunk HEC, configure configuration audit log streaming and network flow log streaming per the instructions above to stream logs directly to your SIEM as if it were Splunk.”

• Vector pipeline Report an error

  “you can use Vector, an open-source high-performance observability data pipeline, to ingest log data from Tailscale by using Vector's Splunk HEC support and deliver it to Vector's many supported SIEM systems, called "sinks" in Vector's terminology.”

• Configuration log streaming Report an error

  “Configuration log streaming lets you export audit and administrative activity from your tailnet to external monitoring, storage, and security platforms.”

• Network log streaming Report an error

  “Network log streaming lets you export network flow logs from your tailnet to external monitoring, storage, and analytics platforms.”

• Private endpoint mechanism Report an error

  “Log streaming to a private endpoint operates by sharing your node into a Tailscale-managed tailnet, where a Tailscale-managed node will publish logs directly to your node.”

• Prerequisites Report an error

  “You need an endpoint and credentials for either your SIEM integration or S3 cloud storage provider.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The DevOps Engineer Logs, audit trail & incident response
• The DevOps Engineer Pricing transparency
• The IT Lead Logs, audit trail & incident response
• The IT Lead Pricing transparency
• The MSP Technician Logs, audit trail & incident response
• The MSP Technician Pricing transparency
• The Operations Manager Logs, audit trail & incident response
• The Information Security Officer Logs, audit trail & incident response
• The Information Security Officer Pricing transparency
• The Skeptic Logs, audit trail & incident response
• The Skeptic Pricing transparency