{"resources":{"tailscale":{"id":"tailscale","name":"tailscale","fields":{"aclPolicy":{"name":"aclPolicy","type":"\u001btailscale.aclPolicy","title":"Tailnet ACL (access control list) policy","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"aclsExternalLink":{"name":"aclsExternalLink","type":"\u0007","title":"Link to the external system managing the ACL policy, empty when the policy is managed in the admin console","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"aclsExternallyManaged":{"name":"aclsExternallyManaged","type":"\u0004","title":"Whether the ACL policy is managed outside the admin console","desc":"True when the tailnet's policy is maintained in an external system, typically a version-controlled repository synced through CI, in which case admin console edits are overwritten. The `aclsExternalLink` field points at that system.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"authKey":{"name":"authKey","type":"\u001btailscale.authKey","title":"Tailscale tailnet key","desc":"Single long-lived credential issued for the tailnet, selected by `id` (for example `tailscale.authKey(id: \"kXZ...\")`). The tailnet key list covers three kinds of credential, which `keyType` distinguishes: pre-auth keys that onboard devices without interactive sign-in, OAuth clients that call the Tailscale API, and federated identities that exchange an external IdP token for API access. Because all three are long-lived, the `expires` and `revoked` timestamps, the `invalid` flag, and the `reusable`, `ephemeral`, and `preauthorized` capability flags are the primary audit signals. `scopes` carries the API access an OAuth client or federated identity holds, where a client granted broad write scopes is effectively a tailnet administrator. `tags` lists the ACL tags any device enrolled with this credential will receive, where over-broad tagging is a common finding. The key material itself is never exposed; only the metadata is.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/tailscale","is_implicit_resource":true},"authKeys":{"name":"authKeys","type":"\u0019\u001btailscale.authKey","title":"Authentication keys (pre-auth keys) issued for the tailnet","min_provider_version":"13.1.8","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"device":{"name":"device","type":"\u001btailscale.device","title":"Tailscale device (also called a node or machine)","desc":"Single device registered in the tailnet, selected by `id`, for example `tailscale.device(id: \"12345\")`. Devices carry much of a tailnet's security posture: whether a node is `authorized` to join, whether it blocks incoming connections, whether key expiry is disabled, its ACL `tags`, its assigned Tailscale addresses, and its tailnet-lock signing state. The `advertisedRoutes` and `enabledRoutes` fields show which subnets the device offers to route and which of those have been approved, so you can audit for unapproved or overbroad subnet routing. `sshEnabled` reports whether the node accepts Tailscale SSH sessions, and `postureSerialNumbers` and `postureHardwareAddresses` carry the hardware identity the tailnet collects when posture identity collection is turned on.","provider":"go.mondoo.com/mql/v13/providers/tailscale","is_implicit_resource":true},"deviceApprovalRequired":{"name":"deviceApprovalRequired","type":"\u0004","title":"Whether new devices must be manually approved before joining the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"devices":{"name":"devices","type":"\u0019\u001btailscale.device","title":"List devices in a tailnet","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"devicesAutoUpdatesEnabled":{"name":"devicesAutoUpdatesEnabled","type":"\u0004","title":"Whether devices in the tailnet are configured to receive automatic Tailscale client updates","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"devicesKeyDurationDays":{"name":"devicesKeyDurationDays","type":"\u0005","title":"Number of days before a device's auth key expires (0 means keys never expire)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"httpsEnabled":{"name":"httpsEnabled","type":"\u0004","title":"Whether HTTPS certificates are enabled for the tailnet","desc":"Required before a node can obtain a certificate for its MagicDNS name, and a prerequisite for exposing a service publicly with Funnel.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"logstream":{"name":"logstream","type":"\u001btailscale.logstream","title":"Tailscale log stream destination","desc":"Configured log stream that forwards tailnet logs to an external destination. `logType` is `configuration` (admin audit log) or `network` (flow log). `destinationType` is one of `splunk`, `elastic`, `panther`, `cribl`, `datadog`, `axiom`, or `s3`. For HTTP sinks `url` and `user` carry the connection details; for S3 sinks `s3Bucket`, `s3Region`, `s3KeyPrefix`, and `s3AuthenticationType` (`accesskey` or `rolearn`) define the bucket and authentication mode, with `s3AccessKeyId` or `s3RoleArn` and `s3ExternalId` filled in accordingly. Tokens and S3 secret access keys are never returned by the Tailscale API and are not exposed here.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/tailscale","is_implicit_resource":true},"logstreams":{"name":"logstreams","type":"\u0019\u001btailscale.logstream","title":"Configured log stream destinations for the tailnet (configuration audit logs, network flow logs)","desc":"Returns at most two entries: one with `logType == \"configuration\"` and one with `logType == \"network\"`. Entries are omitted when no destination is configured for that log type. Use this resource to assert that an organization is exporting tailnet audit and flow logs to a SIEM or object store.","min_provider_version":"13.1.8","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"nameservers":{"name":"nameservers","type":"\u0019\u0007","title":"List global DNS nameservers for a tailnet","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"networkFlowLoggingEnabled":{"name":"networkFlowLoggingEnabled","type":"\u0004","title":"Whether network flow logging is enabled for the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"postureIdentityCollectionEnabled":{"name":"postureIdentityCollectionEnabled","type":"\u0004","title":"Whether device posture identity collection is enabled for the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"regionalRoutingEnabled":{"name":"regionalRoutingEnabled","type":"\u0004","title":"Whether traffic between regions is routed over Tailscale's network rather than taking the shortest path","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"service":{"name":"service","type":"\u001btailscale.service","title":"Tailscale service","desc":"Service published on the tailnet under its own Tailscale address rather than on a single node's address, selected by `name` (for example `tailscale.service(name: \"svc:web\")`). A service is reachable from any node the ACL permits, and the nodes backing it can change without the address changing. `ports` lists the protocol and port ranges the service accepts, where `tcp:*` or a wide range widens the reachable surface, and `tags` carries the ACL tags that decide which nodes may host it and which peers may reach it.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/tailscale","is_implicit_resource":true},"services":{"name":"services","type":"\u0019\u001btailscale.service","title":"Services published on the tailnet under their own Tailscale addresses","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailnet":{"name":"tailnet","type":"\u0007","is_mandatory":true,"title":"Tailnet organization name","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"user":{"name":"user","type":"\u001btailscale.user","title":"Tailscale user","desc":"Single user account known to the tailnet, selected by `id` (for example `tailscale.user(id: \"uid-abc123\")`). Covers the display name, login name, profile picture, owning tailnet, relation type (member or shared), assigned role (owner, admin, member, and other roles), account status (active, idle, suspended, needs-approval, or over-billing-limit), the count of devices the user owns, join and last-seen timestamps, and whether the account is currently connected. Supports access reviews and dormant or suspended-account hygiene.","provider":"go.mondoo.com/mql/v13/providers/tailscale","is_implicit_resource":true},"userApprovalRequired":{"name":"userApprovalRequired","type":"\u0004","title":"Whether new users must be manually approved before joining the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"users":{"name":"users","type":"\u0019\u001btailscale.user","title":"List users of a tailnet","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"usersRoleAllowedToJoinExternalTailnets":{"name":"usersRoleAllowedToJoinExternalTailnets","type":"\u0007","title":"Lowest user role allowed to join external tailnets: 'none' (disabled), 'admin' (admins only), or 'member' (any member)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"webhook":{"name":"webhook","type":"\u001btailscale.webhook","title":"Tailscale webhook endpoint","desc":"Webhook endpoint subscribed to tailnet events, selected by `endpointId` (for example `tailscale.webhook(endpointId: \"whep-abc123CNTRL\")`). Auditing these endpoints surfaces where tailnet activity is routed off-platform and who registered each receiver. `providerType` distinguishes the receiver shape: `slack`, `mattermost`, `googlechat`, `discord`, or empty for a generic Tailscale-formatted POST. `subscriptions` lists the events the endpoint receives (for example `nodeNeedsApproval`, `userSuspended`, `policyUpdate`, or the umbrella `categoryTailnetManagement` / `categoryDeviceMisconfigurations`). `creatorLoginName` is the user that registered the endpoint. The shared HMAC secret is never exposed.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/tailscale","is_implicit_resource":true},"webhooks":{"name":"webhooks","type":"\u0019\u001btailscale.webhook","title":"Webhook endpoints subscribed to tailnet events","min_provider_version":"13.1.8","provider":"go.mondoo.com/mql/v13/providers/tailscale"}},"title":"Tailscale tailnet","desc":"Tailnet (organization) and its security posture: the devices and users it contains, the configured global DNS nameservers, the ACL policy, and the tailnet-wide hardening flags (device-approval and user-approval requirements, automatic-update enrollment, the auth-key expiration window, network-flow logging, posture identity collection, and which user role is allowed to join external tailnets). Also exposes `authKeys` (pre-auth keys issued to onboard devices), `webhooks` (event subscription endpoints), and `logstreams` (audit and network-flow log export destinations).","min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailscale.aclPolicy":{"id":"tailscale.aclPolicy","name":"tailscale.aclPolicy","fields":{"acls":{"name":"acls","type":"\u0019\n","is_mandatory":true,"title":"ACL access rules","desc":"Each entry is a rule granting access, with keys `action` (typically \"accept\"), `src` (source identities the rule applies to), `dst` (destinations as host:port), `proto` (IP protocol), `ports`, `users`, and `srcPosture` (device-posture rule names required of the source).  A tailnet that has moved to `grants` expresses its access rules there instead, and this list is then empty or partial. Read both when auditing what a tailnet permits.","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"attrConfig":{"name":"attrConfig","type":"\u001a\u0007\n","is_mandatory":true,"title":"Configuration for custom device attributes","desc":"Keyed by attribute name. Each value has `type` (`string`, `bool`, or `number`), `allowSetByNode` (whether a node may set the value itself), and `broadcastToPeers` (the destinations the value is shared with). An attribute a node can set for itself should not be trusted as a posture signal.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"autoApproverExitNodes":{"name":"autoApproverExitNodes","type":"\u0019\u0007","is_mandatory":true,"title":"Users or groups whose advertised exit-node routes are auto-approved","desc":"Empty means no users may auto-advertise as exit nodes.","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"autoApproverRoutes":{"name":"autoApproverRoutes","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Subnet routes that are auto-approved when advertised by listed users/groups (CIDR → owners)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"defaultSourcePosture":{"name":"defaultSourcePosture","type":"\u0019\u0007","is_mandatory":true,"title":"Default device-posture rule names applied to every ACL source that doesn't specify its own srcPosture. Empty when posture rules are unused.","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"derpRegions":{"name":"derpRegions","type":"\u0019\n","is_mandatory":true,"title":"Custom DERP relay servers defined for the tailnet","desc":"Each entry describes a region with keys `regionID`, `regionCode`, `regionName`, `avoid`, and `nodes` (the relay hosts, each with `hostName`, `ipv4`, `ipv6`, `derpPort`, `stunPort`, and `stunOnly`). Empty when the tailnet uses only Tailscale's own relays.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"disableIPv4":{"name":"disableIPv4","type":"\u0004","is_mandatory":true,"title":"Whether IPv4 is disabled across the tailnet","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"ETag (version identifier) of the policy","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"grants":{"name":"grants","type":"\u0019\n","is_mandatory":true,"title":"Grant rules","desc":"Tailscale's current form for expressing access, which supersedes `acls` and can additionally grant application capabilities. Each entry has keys `src` (source identities), `dst` (destinations), `ip` (the network-layer ports and protocols allowed), `app` (application capabilities keyed by capability name), `srcPosture` (device-posture rule names required of the source), and `via` (routers the traffic must transit).","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"groups":{"name":"groups","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Named groups of users used in ACL rules (group name → list of members)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"hosts":{"name":"hosts","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Named hosts (alias → IP/CIDR) referenced by ACL rules","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"ipsets":{"name":"ipsets","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Named sets of IP addresses and CIDR ranges referenced by rules (set name to list of addresses)","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"nodeAttrs":{"name":"nodeAttrs","type":"\u0019\n","is_mandatory":true,"title":"Per-node attribute grants","desc":"Each entry grants attributes to a set of nodes, with keys `target` (the nodes the grant applies to), `attr` (attribute names such as \"funnel\" or \"mullvad\"), and `app` (application-connector configuration keyed by app name).","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"omitDefaultDerpRegions":{"name":"omitDefaultDerpRegions","type":"\u0004","is_mandatory":true,"title":"Whether the tailnet's own DERP relays replace Tailscale's default relays rather than adding to them","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"oneCGNATRoute":{"name":"oneCGNATRoute","type":"\u0007","is_mandatory":true,"title":"CGNAT routing setting for the 100.64.0.0/10 range","desc":"Controls whether Tailscale advertises a single 100.64.0.0/10 route instead of individual per-node routes. One of \"enabled\" or \"disabled\".","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"postures":{"name":"postures","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Named device posture rules referenced by name from src/defaultSrcPosture (rule name -\u003e list of posture conditions)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"randomizeClientPort":{"name":"randomizeClientPort","type":"\u0004","is_mandatory":true,"title":"Whether the Tailscale client is set to randomize its source port on each connection","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"raw":{"name":"raw","type":"\u0007","title":"Raw HuJSON representation of the policy","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"ssh":{"name":"ssh","type":"\u0019\n","is_mandatory":true,"title":"Tailscale SSH access rules","desc":"Each entry governs SSH sessions between tailnet nodes, with keys `action` (\"accept\" or \"check\"), `src`, `dst`, `users` (SSH login names allowed on the destination), `checkPeriod` (how long a check-mode authentication is honored), `recorder` (session-recording destinations), and `enforceRecorder` (whether a session is denied when no recorder is reachable).","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tagOwners":{"name":"tagOwners","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Tag owners, the users or groups allowed to assign each ACL tag (tag to list of owners)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailnet":{"name":"tailnet","type":"\u0007","is_mandatory":true,"title":"Tailnet name this ACL policy belongs to","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tests":{"name":"tests","type":"\u0019\n","is_mandatory":true,"title":"Connectivity tests embedded in the policy","desc":"Each entry asserts expected access for a source, with keys `src` (or legacy `user`), `accept` (destinations that must be reachable), `deny` (destinations that must be blocked), and `allow` (legacy alias for accept). Tailscale evaluates these when the policy is saved.","provider":"go.mondoo.com/mql/v13/providers/tailscale"}},"title":"Tailscale tailnet ACL (access control list) policy","desc":"The tailnet's parsed HuJSON ACL policy (https://tailscale.com/kb/1018/acls), which governs which users and devices can reach which others. Auditing this policy surfaces over-broad access rules, tag-owner assignments, Tailscale SSH grants, device-posture requirements, and exit-node or subnet-route auto-approvers. The `raw` field returns the source HuJSON for fall-through pattern matching the structured fields don't cover.","min_provider_version":"13.0.7","defaults":"tailnet","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailscale.authKey":{"id":"tailscale.authKey","name":"tailscale.authKey","fields":{"audience":{"name":"audience","type":"\u0007","is_mandatory":true,"title":"Audience the external identity provider must name in tokens presented by a federated identity","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the key was created","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"customClaimRules":{"name":"customClaimRules","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Additional claims an external identity provider's token must carry for a federated identity to be accepted (claim name to required value)","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description set when the key was created","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"ephemeral":{"name":"ephemeral","type":"\u0004","is_mandatory":true,"title":"Whether devices created with the key are ephemeral (auto-removed when offline)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"expires":{"name":"expires","type":"\t","is_mandatory":true,"title":"Time the key expires; the zero value means the key never expires","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"hasExpiration":{"name":"hasExpiration","type":"\u0004","title":"Whether the key has an expiration set (false means the key never expires)","min_provider_version":"13.2.4","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Identifier of the key","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"invalid":{"name":"invalid","type":"\u0004","is_mandatory":true,"title":"Whether the key has been marked invalid (revoked or its tailnet was deleted)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"isRevoked":{"name":"isRevoked","type":"\u0004","title":"Whether the key has been revoked","min_provider_version":"13.2.4","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Issuer URL of the external identity provider trusted by a federated identity","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"keyType":{"name":"keyType","type":"\u0007","is_mandatory":true,"title":"Kind of credential this key represents","desc":"`client` for an OAuth client, `federated` for a federated identity, and empty or `auth` for a pre-auth key that onboards devices.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"preauthorized":{"name":"preauthorized","type":"\u0004","is_mandatory":true,"title":"Whether devices created with the key are pre-approved into a tailnet that requires device approval","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"reusable":{"name":"reusable","type":"\u0004","is_mandatory":true,"title":"Whether the key can be used to authenticate more than one device","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"revoked":{"name":"revoked","type":"\t","is_mandatory":true,"title":"Time the key was revoked; the zero value means the key has not been revoked","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"API scopes granted to an OAuth client or federated identity","desc":"For example `devices:core:read` or `all:write`. Empty for pre-auth keys, which onboard devices rather than calling the API.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"subject":{"name":"subject","type":"\u0007","is_mandatory":true,"title":"Subject claim the external identity provider must assert for a federated identity to be accepted","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"ACL tags applied to devices that authenticate using this key","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"updated":{"name":"updated","type":"\t","is_mandatory":true,"title":"Time the key was last modified","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"userId":{"name":"userId","type":"\u0007","is_mandatory":true,"title":"ID of the user that owns the key","provider":"go.mondoo.com/mql/v13/providers/tailscale"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"Tailscale tailnet key","desc":"Single long-lived credential issued for the tailnet, selected by `id` (for example `tailscale.authKey(id: \"kXZ...\")`). The tailnet key list covers three kinds of credential, which `keyType` distinguishes: pre-auth keys that onboard devices without interactive sign-in, OAuth clients that call the Tailscale API, and federated identities that exchange an external IdP token for API access. Because all three are long-lived, the `expires` and `revoked` timestamps, the `invalid` flag, and the `reusable`, `ephemeral`, and `preauthorized` capability flags are the primary audit signals. `scopes` carries the API access an OAuth client or federated identity holds, where a client granted broad write scopes is effectively a tailnet administrator. `tags` lists the ACL tags any device enrolled with this credential will receive, where over-broad tagging is a common finding. The key material itself is never exposed; only the metadata is.","private":true,"min_provider_version":"13.1.8","defaults":"id keyType description expires revoked","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailscale.device":{"id":"tailscale.device","name":"tailscale.device","fields":{"addresses":{"name":"addresses","type":"\u0019\u0007","is_mandatory":true,"title":"List of Tailscale IP addresses for the device, including both IPv4 and IPv6 addresses","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"advertisedRoutes":{"name":"advertisedRoutes","type":"\u0019\u0007","is_mandatory":true,"title":"Subnet routes that the device is advertising","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"authorized":{"name":"authorized","type":"\u0004","is_mandatory":true,"title":"Whether the device is authorized to join the tailnet","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"blocksIncomingConnections":{"name":"blocksIncomingConnections","type":"\u0004","is_mandatory":true,"title":"Whether the device is blocked from accepting connections over Tailscale, including pings","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"clientVersion":{"name":"clientVersion","type":"\u0007","is_mandatory":true,"title":"Version of the Tailscale client software (empty for external devices)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"connectedToControl":{"name":"connectedToControl","type":"\u0004","is_mandatory":true,"title":"Whether the device currently holds a connection to the Tailscale coordination server","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Date when the device was added to the tailnet","desc":"Null for devices Tailscale reports no creation date for, which includes external devices shared into the tailnet.","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"derpRelay":{"name":"derpRelay","type":"\u0007","is_mandatory":true,"title":"DERP relay the device falls back to when a direct connection cannot be established","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"distroCodeName":{"name":"distroCodeName","type":"\u0007","is_mandatory":true,"title":"Operating system distribution code name reported by the client, for example 'noble'","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"distroName":{"name":"distroName","type":"\u0007","is_mandatory":true,"title":"Operating system distribution name reported by the client, for example 'ubuntu' or 'debian'","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"distroVersion":{"name":"distroVersion","type":"\u0007","is_mandatory":true,"title":"Operating system distribution version reported by the client","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"enabledRoutes":{"name":"enabledRoutes","type":"\u0019\u0007","is_mandatory":true,"title":"Subnet routes that are enabled (allowed) for the device, its effective subnet scope","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"endpoints":{"name":"endpoints","type":"\u0019\u0007","is_mandatory":true,"title":"Public endpoints the client last advertised for direct connections, as host:port","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Expiration date of the device's key","desc":"Null when the key is set never to expire, which `keyExpiryDisabled` also reports. A comparison against this field therefore selects only devices whose key can expire.","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"Machine name in the admin console","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Legacy identifier for a device","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"isEphemeral":{"name":"isEphemeral","type":"\u0004","is_mandatory":true,"title":"Whether the device was registered with an ephemeral auth key and is removed automatically once it goes offline","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"isExternal":{"name":"isExternal","type":"\u0004","is_mandatory":true,"title":"Whether a device is shared into the tailnet (rather than a member of the tailnet)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"keyExpiryDisabled":{"name":"keyExpiryDisabled","type":"\u0004","is_mandatory":true,"title":"Whether key expiration is disabled for the device","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"lastSeenAt":{"name":"lastSeenAt","type":"\t","is_mandatory":true,"title":"When device was last active on the tailnet","desc":"Null while the device holds a connection to the coordination server, because \"last seen\" has no meaning for a device that is seen right now. Pair with `connectedToControl` when auditing for dormant devices.","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"machineKey":{"name":"machineKey","type":"\u0007","is_mandatory":true,"title":"Machine key used by Tailscale (empty for external devices)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"mappingVariesByDestIp":{"name":"mappingVariesByDestIp","type":"\u0004","is_mandatory":true,"title":"Whether the device's NAT maps it to a different external port per destination","desc":"True indicates hard or symmetric NAT, which prevents direct peer connections and forces traffic through a DERP relay.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"MagicDNS name of the device","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"nodeId":{"name":"nodeId","type":"\u0007","is_mandatory":true,"title":"Preferred identifier for a device","desc":"Tailscale's current device identifier, which supersedes the numeric `id`. Both address the same device through the API.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"nodeKey":{"name":"nodeKey","type":"\u0007","is_mandatory":true,"title":"Node key primarily used by Tailscale and required for select operations, such as adding a node to a locked tailnet","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"os":{"name":"os","type":"\u0007","is_mandatory":true,"title":"Operating system that the device is running","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"postureHardwareAddresses":{"name":"postureHardwareAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Hardware (MAC) addresses collected from the device","desc":"Populated only when posture identity collection is turned on for the tailnet.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"postureIdentityDisabled":{"name":"postureIdentityDisabled","type":"\u0004","is_mandatory":true,"title":"Whether posture identity collection is turned off for this specific device","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"postureSerialNumbers":{"name":"postureSerialNumbers","type":"\u0019\u0007","is_mandatory":true,"title":"Hardware serial numbers collected from the device","desc":"Populated only when posture identity collection is turned on for the tailnet, which `postureIdentityCollectionEnabled` on `tailscale` reports. Empty when collection is off or the client reported none.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"sshEnabled":{"name":"sshEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the device accepts Tailscale SSH sessions","desc":"A node with Tailscale SSH turned on serves SSH to any peer the ACL `ssh` rules permit, bypassing the host's own sshd and its authorized_keys. Combine with the `ssh` rules on `tailscale.aclPolicy` to see who can reach it.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"An identity for the device that is separate from human users (used as part of an ACL to restrict access)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailnetLockError":{"name":"tailnetLockError","type":"\u0007","is_mandatory":true,"title":"Issue with the tailnet lock node-key signature on this device (only populated when tailnet lock is enabled)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailnetLockKey":{"name":"tailnetLockKey","type":"\u0007","is_mandatory":true,"title":"Node's tailnet lock key","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"updateAvailable":{"name":"updateAvailable","type":"\u0004","is_mandatory":true,"title":"Whether a Tailscale client version upgrade is available (empty for external devices)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"User who registered the device. For untagged devices this is also the device owner.","provider":"go.mondoo.com/mql/v13/providers/tailscale"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"Tailscale device (also called a node or machine)","desc":"Single device registered in the tailnet, selected by `id`, for example `tailscale.device(id: \"12345\")`. Devices carry much of a tailnet's security posture: whether a node is `authorized` to join, whether it blocks incoming connections, whether key expiry is disabled, its ACL `tags`, its assigned Tailscale addresses, and its tailnet-lock signing state. The `advertisedRoutes` and `enabledRoutes` fields show which subnets the device offers to route and which of those have been approved, so you can audit for unapproved or overbroad subnet routing. `sshEnabled` reports whether the node accepts Tailscale SSH sessions, and `postureSerialNumbers` and `postureHardwareAddresses` carry the hardware identity the tailnet collects when posture identity collection is turned on.","min_provider_version":"11.0.0","defaults":"id hostname os","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailscale.logstream":{"id":"tailscale.logstream","name":"tailscale.logstream","fields":{"destinationType":{"name":"destinationType","type":"\u0007","is_mandatory":true,"title":"Destination service receiving the stream","desc":"One of `splunk`, `elastic`, `panther`, `cribl`, `datadog`, `axiom`, or `s3`.","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"logType":{"name":"logType","type":"\u0007","is_mandatory":true,"title":"Log feed this stream carries: `configuration` (audit log) or `network` (flow log)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"s3AccessKeyId":{"name":"s3AccessKeyId","type":"\u0007","is_mandatory":true,"title":"Access key ID used when `s3AuthenticationType == \"accesskey\"`","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"s3AuthenticationType":{"name":"s3AuthenticationType","type":"\u0007","is_mandatory":true,"title":"S3 authentication mode (`accesskey` or `rolearn`)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"s3Bucket":{"name":"s3Bucket","type":"\u0007","is_mandatory":true,"title":"S3 bucket name when `destinationType == \"s3\"`","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"s3ExternalId":{"name":"s3ExternalId","type":"\u0007","is_mandatory":true,"title":"External ID Tailscale must include when assuming the role","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"s3KeyPrefix":{"name":"s3KeyPrefix","type":"\u0007","is_mandatory":true,"title":"S3 key prefix prepended to written objects when `destinationType == \"s3\"`","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"s3Region":{"name":"s3Region","type":"\u0007","is_mandatory":true,"title":"S3 region when `destinationType == \"s3\"`","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"s3RoleArn":{"name":"s3RoleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the IAM role Tailscale assumes when `s3AuthenticationType == \"rolearn\"`","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Endpoint URL for HTTP destinations","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"Username for HTTP destinations that authenticate with basic credentials","provider":"go.mondoo.com/mql/v13/providers/tailscale"}},"title":"Tailscale log stream destination","desc":"Configured log stream that forwards tailnet logs to an external destination. `logType` is `configuration` (admin audit log) or `network` (flow log). `destinationType` is one of `splunk`, `elastic`, `panther`, `cribl`, `datadog`, `axiom`, or `s3`. For HTTP sinks `url` and `user` carry the connection details; for S3 sinks `s3Bucket`, `s3Region`, `s3KeyPrefix`, and `s3AuthenticationType` (`accesskey` or `rolearn`) define the bucket and authentication mode, with `s3AccessKeyId` or `s3RoleArn` and `s3ExternalId` filled in accordingly. Tokens and S3 secret access keys are never returned by the Tailscale API and are not exposed here.","private":true,"min_provider_version":"13.1.8","defaults":"logType destinationType","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailscale.service":{"id":"tailscale.service","name":"tailscale.service","fields":{"addresses":{"name":"addresses","type":"\u0019\u0007","is_mandatory":true,"title":"Tailscale IP addresses assigned to the service, including both IPv4 and IPv6 addresses","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Arbitrary key/value annotations attached to the service","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Human-readable comment set when the service was defined","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the service, including the 'svc:' prefix","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"ports":{"name":"ports","type":"\u0019\u0007","is_mandatory":true,"title":"Protocol and port ranges the service accepts","desc":"Each entry is a protocol and port specification such as `tcp:443`, `udp:53`, or `tcp:8000-8080`. The value `*` accepts every port on every protocol.","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"ACL tags applied to the service","provider":"go.mondoo.com/mql/v13/providers/tailscale"}},"init":{"args":[{"name":"name","type":"\u0007","optional":true}]},"title":"Tailscale service","desc":"Service published on the tailnet under its own Tailscale address rather than on a single node's address, selected by `name` (for example `tailscale.service(name: \"svc:web\")`). A service is reachable from any node the ACL permits, and the nodes backing it can change without the address changing. `ports` lists the protocol and port ranges the service accepts, where `tcp:*` or a wide range widens the reachable surface, and `tags` carries the ACL tags that decide which nodes may host it and which peers may reach it.","private":true,"min_provider_version":"13.3.11","defaults":"name ports","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailscale.user":{"id":"tailscale.user","name":"tailscale.user","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the user joined the tailnet","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"currentlyConnected":{"name":"currentlyConnected","type":"\u0004","is_mandatory":true,"title":"Whether the user is currently connected to the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"deviceCount":{"name":"deviceCount","type":"\u0005","is_mandatory":true,"title":"Number of devices the user owns","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Name of the user","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the user","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"lastSeenAt":{"name":"lastSeenAt","type":"\t","is_mandatory":true,"title":"Last time the user was active on the tailnet, either via a node connection or by authenticating to a Tailscale service (including the admin panel)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"loginName":{"name":"loginName","type":"\u0007","is_mandatory":true,"title":"Email-like login name of the user","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"profilePicUrl":{"name":"profilePicUrl","type":"\u0007","is_mandatory":true,"title":"Profile picture URL for the user","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Role of the user (owner, member, admin, etc.)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the user","desc":"'active' - Last seen within 28 days 'idle' - Last seen more than 28 days ago 'suspended' - Suspended from accessing the tailnet 'needs-approval' - Unable to join tailnet until approved 'over-billing-limit' - Unable to join tailnet until billing count increased","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailnetId":{"name":"tailnetId","type":"\u0007","is_mandatory":true,"title":"Tailnet that owns the user","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type of relation this user has to the tailnet (member or shared)","provider":"go.mondoo.com/mql/v13/providers/tailscale"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"Tailscale user","desc":"Single user account known to the tailnet, selected by `id` (for example `tailscale.user(id: \"uid-abc123\")`). Covers the display name, login name, profile picture, owning tailnet, relation type (member or shared), assigned role (owner, admin, member, and other roles), account status (active, idle, suspended, needs-approval, or over-billing-limit), the count of devices the user owns, join and last-seen timestamps, and whether the account is currently connected. Supports access reviews and dormant or suspended-account hygiene.","min_provider_version":"11.0.0","defaults":"id displayName type","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"tailscale.webhook":{"id":"tailscale.webhook","name":"tailscale.webhook","fields":{"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the endpoint was registered","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"creatorLoginName":{"name":"creatorLoginName","type":"\u0007","is_mandatory":true,"title":"Login name of the user that registered the endpoint","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"endpointId":{"name":"endpointId","type":"\u0007","is_mandatory":true,"title":"Identifier of the webhook endpoint","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"endpointUrl":{"name":"endpointUrl","type":"\u0007","is_mandatory":true,"title":"URL events are POSTed to","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"lastModified":{"name":"lastModified","type":"\t","is_mandatory":true,"title":"Time the endpoint subscription was last modified","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"providerType":{"name":"providerType","type":"\u0007","is_mandatory":true,"title":"Receiver shape (`slack`, `mattermost`, `googlechat`, `discord`, or empty for the generic Tailscale format)","provider":"go.mondoo.com/mql/v13/providers/tailscale"},"subscriptions":{"name":"subscriptions","type":"\u0019\u0007","is_mandatory":true,"title":"Events the endpoint is subscribed to","desc":"Individual events such as `nodeCreated`, `nodeNeedsApproval`, `nodeApproved`, `nodeKeyExpiringInOneDay`, `nodeKeyExpired`, `nodeDeleted`, `policyUpdate`, `userCreated`, `userNeedsApproval`, `userSuspended`, `userRestored`, `userDeleted`, `userApproved`, `userRoleUpdated`, `subnetIPForwardingNotEnabled`, `exitNodeIPForwardingNotEnabled`. Umbrella categories `categoryTailnetManagement` and `categoryDeviceMisconfigurations` subscribe to every event in their group, including future additions.","provider":"go.mondoo.com/mql/v13/providers/tailscale"}},"init":{"args":[{"name":"endpointId","type":"\u0007","optional":true}]},"title":"Tailscale webhook endpoint","desc":"Webhook endpoint subscribed to tailnet events, selected by `endpointId` (for example `tailscale.webhook(endpointId: \"whep-abc123CNTRL\")`). Auditing these endpoints surfaces where tailnet activity is routed off-platform and who registered each receiver. `providerType` distinguishes the receiver shape: `slack`, `mattermost`, `googlechat`, `discord`, or empty for a generic Tailscale-formatted POST. `subscriptions` lists the events the endpoint receives (for example `nodeNeedsApproval`, `userSuspended`, `policyUpdate`, or the umbrella `categoryTailnetManagement` / `categoryDeviceMisconfigurations`). `creatorLoginName` is the user that registered the endpoint. The shared HMAC secret is never exposed.","private":true,"min_provider_version":"13.1.8","defaults":"endpointId providerType endpointUrl","provider":"go.mondoo.com/mql/v13/providers/tailscale"}}}