Tailscale
Coming soon Free · OSSVPN & remote access
Mesh VPN that turns every device into a peer-addressable node — free tier is brutally good.
Tailscale homepage ↗WireGuard-based mesh that turns every device into a peer-addressable node on a private tailnet. Generous free tier — 3 users + 100 devices, ACLs, exit nodes, identity-backed access, and full Network Logs included on Personal plans. The security event surface of a fleet-scale VPN with the operational simplicity of a chat app.
What it watches
- New device added to the tailnet — fresh authkey + identity
- Peer-to-peer connection events with src/dst node + ACL grant
- ACL policy + tag changes (who can reach what)
- Exit-node advertisements + usage spikes
- Subnet-route advertisements (potential pivot path opened)
- Authentication + reauthentication events on the SSO identity
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
What it helps you catch
What you'd see in CyberCLI
illustrativeNew device joined tailnet at 02:14 — auth-key 'ops-eng-keys' from NL
- user
- ops-eng@bladeglobal.com
- hostname
- macbook-pro-3
- country
- NL
- auth_key
- ops-eng-keys
Routed to Warden (triage) → Knight (detection) → Paladin (containment)
Suggested Verify with operator · ACL-tag review (needs approval)
⛓ every step hash-chained · replayable
What CyberCLI reads from Tailscale
parser roadmap · v1.xTailscale's Network Logs API streams every peer connection on your tailnet — src/dst node identity, port, bytes, accept/drop reason — plus the device-add and ACL-change events that matter for posture. We'd read ~19 fields (parser roadmap, engine v1.x) carrying user identity, device name, ACL tag, connection outcome, and the policy match. Personal/Free tailnets include the same Network Logs as paid plans, which is why Tailscale is one of the highest-ROI free connectors on the entire roster.
Event categories we'll parse
- Network log accept network_log_accept
A peer connection allowed by ACL — src/dst node + identity + port + bytes + matched policy.
- Network log drop network_log_drop
A peer connection denied by ACL — same fields plus the rule that blocked it (the audit trail when you tighten policy).
- Device added device_added
A new device joined the tailnet — auth-key used, OS, hostname, country of first connection.
- Acl change acl_change
Tailnet ACL or tag policy changed — actor, diff, prior policy hash.
- Ssh session ssh_session
Tailscale SSH session start/end with identity + destination (Business+ tailnet feature; surfaced for completeness).
The engine parser for Tailscale is on the v1.x roadmap. The MITRE map + Trust Ladder ceiling below are doctrine — what we'd authorize the AI to do on this connector's signals — and they ship the moment the parser merges. We publish them now so design partners can scope where Tailscale sits in their incident response before they install us.
MITRE techniques typically mapped
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest tailnet events, notify on new devices + ACL changes, summarize peer-flow anomalies for the case
- ·L3 (Knight verification): cross-reference device identity with M365 sign-in events, query the Tailscale API for device posture — read-only
- ·L4+: device removal, auth-key revocation, ACL policy edits — tailnet membership stays operator-owned
- ·Even on Pro+, Paladin doesn't touch the Tailscale control plane; the operator owns membership decisions
Full ladder semantics · /trust →
Doctrine page — the parser is roadmap. When the engine commits the Tailscale VRL parser, this page auto-promotes to live numbers + sample event without a marketing edit.
Close more of the kill chain
Tailscale covers 4 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
Tailscale is on the connector roadmap but not yet bundled. The plan above describes what we'll ingest + how it maps to MITRE; install instructions land when the connector pack ships.
Tell us you'd use it → Pro tier customers get priority on connector prioritisation.
Tailnet metadata sits at Tailscale (coordinator-only, never traffic content). Network Logs ship from your tailnet to your CyberCLI install in your environment. For full sovereignty, point Tailscale at Headscale (self-hosted coordinator).