{"resources":{"tailscale":{"id":"tailscale","name":"tailscale","fields":{"aclPolicy":{"name":"aclPolicy","type":"\u001btailscale.aclPolicy","title":"Tailnet ACL (access control list) policy","provider":"go.mondoo.com/mql/providers/tailscale"},"aclsExternalLink":{"name":"aclsExternalLink","type":"\u0007","title":"Link to the external system managing the ACL policy, empty when the policy is managed in the admin console","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"aclsExternallyManaged":{"name":"aclsExternallyManaged","type":"\u0004","title":"Whether the ACL policy is managed outside the admin console","desc":"True when the tailnet's policy is maintained in an external system, typically a version-controlled repository synced through CI, in which case admin console edits are overwritten. The `aclsExternalLink` field points at that system.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/tailscale","is_implicit_resource":true},"authKey":{"name":"authKey","type":"\u001btailscale.authKey","title":"Tailscale tailnet key","desc":"Single long-lived credential issued for the tailnet, selected by `id` (for example `tailscale.authKey(id: \"kXZ...\")`). The tailnet key list covers three kinds of credential, which `keyType` distinguishes: pre-auth keys that onboard devices without interactive sign-in, OAuth clients that call the Tailscale API, and federated identities that exchange an external IdP token for API access. Because all three are long-lived, the `expires` and `revoked` timestamps, the `invalid` flag, and the `reusable`, `ephemeral`, and `preauthorized` capability flags are the primary audit signals. `scopes` carries the API access an OAuth client or federated identity holds, where a client granted broad write scopes is effectively a tailnet administrator. `tags` lists the ACL tags any device enrolled with this credential will receive, where over-broad tagging is a common finding. The key material itself is never exposed; only the metadata is.","is_private":true,"provider":"go.mondoo.com/mql/providers/tailscale","is_implicit_resource":true},"authKeys":{"name":"authKeys","type":"\u0019\u001btailscale.authKey","title":"Authentication keys (pre-auth keys) issued for the tailnet","min_provider_version":"13.1.8","provider":"go.mondoo.com/mql/providers/tailscale"},"device":{"name":"device","type":"\u001btailscale.device","title":"Tailscale device (also called a node or machine)","desc":"Single device registered in the tailnet, selected by `id`, for example `tailscale.device(id: \"12345\")`. Devices carry much of a tailnet's security posture: whether a node is `authorized` to join, whether it blocks incoming connections, whether key expiry is disabled, its ACL `tags`, its assigned Tailscale addresses, and its tailnet-lock signing state. The `advertisedRoutes` and `enabledRoutes` fields show which subnets the device offers to route and which of those have been approved, so you can audit for unapproved or overbroad subnet routing. `sshEnabled` reports whether the node accepts Tailscale SSH sessions, and `postureSerialNumbers` and `postureHardwareAddresses` carry the hardware identity the tailnet collects when posture identity collection is turned on.","provider":"go.mondoo.com/mql/providers/tailscale","is_implicit_resource":true},"deviceApprovalRequired":{"name":"deviceApprovalRequired","type":"\u0004","title":"Whether new devices must be manually approved before joining the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"devices":{"name":"devices","type":"\u0019\u001btailscale.device","title":"List devices in a tailnet","provider":"go.mondoo.com/mql/providers/tailscale"},"devicesAutoUpdatesEnabled":{"name":"devicesAutoUpdatesEnabled","type":"\u0004","title":"Whether devices in the tailnet are configured to receive automatic Tailscale client updates","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"devicesKeyDurationDays":{"name":"devicesKeyDurationDays","type":"\u0005","title":"Number of days before a device's auth key expires (0 means keys never expire)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"httpsEnabled":{"name":"httpsEnabled","type":"\u0004","title":"Whether HTTPS certificates are enabled for the tailnet","desc":"Required before a node can obtain a certificate for its MagicDNS name, and a prerequisite for exposing a service publicly with Funnel.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"logstream":{"name":"logstream","type":"\u001btailscale.logstream","title":"Tailscale log stream destination","desc":"Configured log stream that forwards tailnet logs to an external destination. `logType` is `configuration` (admin audit log) or `network` (flow log). `destinationType` is one of `splunk`, `elastic`, `panther`, `cribl`, `datadog`, `axiom`, or `s3`. For HTTP sinks `url` and `user` carry the connection details; for S3 sinks `s3Bucket`, `s3Region`, `s3KeyPrefix`, and `s3AuthenticationType` (`accesskey` or `rolearn`) define the bucket and authentication mode, with `s3AccessKeyId` or `s3RoleArn` and `s3ExternalId` filled in accordingly. Tokens and S3 secret access keys are never returned by the Tailscale API and are not exposed here.","is_private":true,"provider":"go.mondoo.com/mql/providers/tailscale","is_implicit_resource":true},"logstreams":{"name":"logstreams","type":"\u0019\u001btailscale.logstream","title":"Configured log stream destinations for the tailnet (configuration audit logs, network flow logs)","desc":"Returns at most two entries: one with `logType == \"configuration\"` and one with `logType == \"network\"`. Entries are omitted when no destination is configured for that log type. Use this resource to assert that an organization is exporting tailnet audit and flow logs to a SIEM or object store.","min_provider_version":"13.1.8","provider":"go.mondoo.com/mql/providers/tailscale"},"nameservers":{"name":"nameservers","type":"\u0019\u0007","title":"List global DNS nameservers for a tailnet","provider":"go.mondoo.com/mql/providers/tailscale"},"networkFlowLoggingEnabled":{"name":"networkFlowLoggingEnabled","type":"\u0004","title":"Whether network flow logging is enabled for the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"postureIdentityCollectionEnabled":{"name":"postureIdentityCollectionEnabled","type":"\u0004","title":"Whether device posture identity collection is enabled for the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"regionalRoutingEnabled":{"name":"regionalRoutingEnabled","type":"\u0004","title":"Whether traffic between regions is routed over Tailscale's network rather than taking the shortest path","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"service":{"name":"service","type":"\u001btailscale.service","title":"Tailscale service","desc":"Service published on the tailnet under its own Tailscale address rather than on a single node's address, selected by `name` (for example `tailscale.service(name: \"svc:web\")`). A service is reachable from any node the ACL permits, and the nodes backing it can change without the address changing. `ports` lists the protocol and port ranges the service accepts, where `tcp:*` or a wide range widens the reachable surface, and `tags` carries the ACL tags that decide which nodes may host it and which peers may reach it.","is_private":true,"provider":"go.mondoo.com/mql/providers/tailscale","is_implicit_resource":true},"services":{"name":"services","type":"\u0019\u001btailscale.service","title":"Services published on the tailnet under their own Tailscale addresses","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"tailnet":{"name":"tailnet","type":"\u0007","is_mandatory":true,"title":"Tailnet organization name","provider":"go.mondoo.com/mql/providers/tailscale"},"user":{"name":"user","type":"\u001btailscale.user","title":"Tailscale user","desc":"Single user account known to the tailnet, selected by `id` (for example `tailscale.user(id: \"uid-abc123\")`). Covers the display name, login name, profile picture, owning tailnet, relation type (member or shared), assigned role (owner, admin, member, and other roles), account status (active, idle, suspended, needs-approval, or over-billing-limit), the count of devices the user owns, join and last-seen timestamps, and whether the account is currently connected. Supports access reviews and dormant or suspended-account hygiene.","provider":"go.mondoo.com/mql/providers/tailscale","is_implicit_resource":true},"userApprovalRequired":{"name":"userApprovalRequired","type":"\u0004","title":"Whether new users must be manually approved before joining the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"users":{"name":"users","type":"\u0019\u001btailscale.user","title":"List users of a tailnet","provider":"go.mondoo.com/mql/providers/tailscale"},"usersRoleAllowedToJoinExternalTailnets":{"name":"usersRoleAllowedToJoinExternalTailnets","type":"\u0007","title":"Lowest user role allowed to join external tailnets: 'none' (disabled), 'admin' (admins only), or 'member' (any member)","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"webhook":{"name":"webhook","type":"\u001btailscale.webhook","title":"Tailscale webhook endpoint","desc":"Webhook endpoint subscribed to tailnet events, selected by `endpointId` (for example `tailscale.webhook(endpointId: \"whep-abc123CNTRL\")`). Auditing these endpoints surfaces where tailnet activity is routed off-platform and who registered each receiver. `providerType` distinguishes the receiver shape: `slack`, `mattermost`, `googlechat`, `discord`, or empty for a generic Tailscale-formatted POST. `subscriptions` lists the events the endpoint receives (for example `nodeNeedsApproval`, `userSuspended`, `policyUpdate`, or the umbrella `categoryTailnetManagement` / `categoryDeviceMisconfigurations`). `creatorLoginName` is the user that registered the endpoint. The shared HMAC secret is never exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/tailscale","is_implicit_resource":true},"webhooks":{"name":"webhooks","type":"\u0019\u001btailscale.webhook","title":"Webhook endpoints subscribed to tailnet events","min_provider_version":"13.1.8","provider":"go.mondoo.com/mql/providers/tailscale"}},"title":"Tailscale tailnet","desc":"Tailnet (organization) and its security posture: the devices and users it contains, the configured global DNS nameservers, the ACL policy, and the tailnet-wide hardening flags (device-approval and user-approval requirements, automatic-update enrollment, the auth-key expiration window, network-flow logging, posture identity collection, and which user role is allowed to join external tailnets). Also exposes `authKeys` (pre-auth keys issued to onboard devices), `webhooks` (event subscription endpoints), and `logstreams` (audit and network-flow log export destinations).","min_provider_version":"11.0.0","provider":"go.mondoo.com/mql/providers/tailscale","root":true},"tailscale.aclPolicy":{"id":"tailscale.aclPolicy","name":"tailscale.aclPolicy","fields":{"acls":{"name":"acls","type":"\u0019\n","is_mandatory":true,"title":"ACL access rules","desc":"Each entry is a rule granting access, with keys `action` (typically \"accept\"), `src` (source identities the rule applies to), `dst` (destinations as host:port), `proto` (IP protocol), `ports`, `users`, and `srcPosture` (device-posture rule names required of the source).  A tailnet that has moved to `grants` expresses its access rules there instead, and this list is then empty or partial. Read both when auditing what a tailnet permits.","provider":"go.mondoo.com/mql/providers/tailscale"},"attrConfig":{"name":"attrConfig","type":"\u001a\u0007\n","is_mandatory":true,"title":"Configuration for custom device attributes","desc":"Keyed by attribute name. Each value has `type` (`string`, `bool`, or `number`), `allowSetByNode` (whether a node may set the value itself), and `broadcastToPeers` (the destinations the value is shared with). An attribute a node can set for itself should not be trusted as a posture signal.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"autoApproverExitNodes":{"name":"autoApproverExitNodes","type":"\u0019\u0007","is_mandatory":true,"title":"Users or groups whose advertised exit-node routes are auto-approved","desc":"Empty means no users may auto-advertise as exit nodes.","provider":"go.mondoo.com/mql/providers/tailscale"},"autoApproverRoutes":{"name":"autoApproverRoutes","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Subnet routes that are auto-approved when advertised by listed users/groups (CIDR → owners)","provider":"go.mondoo.com/mql/providers/tailscale"},"autoApproverServices":{"name":"autoApproverServices","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Tailnet services whose advertisement is auto-approved when advertised by listed users/groups (service name → owners)","desc":"A listed owner can stand up the named service under its stable VIP and have the advertisement approved without an administrator acting on it. Empty means every service advertisement needs approval.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/tailscale"},"defaultSourcePosture":{"name":"defaultSourcePosture","type":"\u0019\u0007","is_mandatory":true,"title":"Default device-posture rule names applied to every ACL source that doesn't specify its own srcPosture. Empty when posture rules are unused.","provider":"go.mondoo.com/mql/providers/tailscale"},"derpRegions":{"name":"derpRegions","type":"\u0019\n","is_mandatory":true,"title":"Custom DERP relay servers defined for the tailnet","desc":"Each entry describes a region with keys `regionID`, `regionCode`, `regionName`, `avoid`, and `nodes` (the relay hosts, each with `hostName`, `ipv4`, `ipv6`, `derpPort`, `stunPort`, and `stunOnly`). Empty when the tailnet uses only Tailscale's own relays.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"disableIPv4":{"name":"disableIPv4","type":"\u0004","is_mandatory":true,"title":"Whether IPv4 is disabled across the tailnet","provider":"go.mondoo.com/mql/providers/tailscale"},"etag":{"name":"etag","type":"\u0007","is_mandatory":true,"title":"ETag (version identifier) of the policy","provider":"go.mondoo.com/mql/providers/tailscale"},"grants":{"name":"grants","type":"\u0019\n","is_mandatory":true,"title":"Grant rules","desc":"Tailscale's current form for expressing access, which supersedes `acls` and can additionally grant application capabilities. Each entry has keys `src` (source identities), `dst` (destinations), `ip` (the network-layer ports and protocols allowed), `app` (application capabilities keyed by capability name), `srcPosture` (device-posture rule names required of the source), and `via` (routers the traffic must transit).","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"groups":{"name":"groups","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Named groups of users used in ACL rules (group name → list of members)","provider":"go.mondoo.com/mql/providers/tailscale"},"hosts":{"name":"hosts","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Named hosts (alias → IP/CIDR) referenced by ACL rules","provider":"go.mondoo.com/mql/providers/tailscale"},"ipsets":{"name":"ipsets","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Named sets of IP addresses and CIDR ranges referenced by rules (set name to list of addresses)","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"nodeAttrs":{"name":"nodeAttrs","type":"\u0019\n","is_mandatory":true,"title":"Per-node attribute grants","desc":"Each entry grants attributes to a set of nodes, with keys `target` (the nodes the grant applies to), `attr` (attribute names such as \"funnel\" or \"mullvad\"), and `app` (application-connector configuration keyed by app name).","provider":"go.mondoo.com/mql/providers/tailscale"},"omitDefaultDerpRegions":{"name":"omitDefaultDerpRegions","type":"\u0004","is_mandatory":true,"title":"Whether the tailnet's own DERP relays replace Tailscale's default relays rather than adding to them","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"oneCGNATRoute":{"name":"oneCGNATRoute","type":"\u0007","is_mandatory":true,"title":"CGNAT routing setting for the 100.64.0.0/10 range","desc":"Controls whether Tailscale advertises a single 100.64.0.0/10 route instead of individual per-node routes. One of \"enabled\" or \"disabled\".","provider":"go.mondoo.com/mql/providers/tailscale"},"postures":{"name":"postures","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Named device posture rules referenced by name from src/defaultSrcPosture (rule name -\u003e list of posture conditions)","provider":"go.mondoo.com/mql/providers/tailscale"},"randomizeClientPort":{"name":"randomizeClientPort","type":"\u0004","is_mandatory":true,"title":"Whether the Tailscale client is set to randomize its source port on each connection","provider":"go.mondoo.com/mql/providers/tailscale"},"raw":{"name":"raw","type":"\u0007","title":"Raw HuJSON representation of the policy","provider":"go.mondoo.com/mql/providers/tailscale"},"ssh":{"name":"ssh","type":"\u0019\n","is_mandatory":true,"title":"Tailscale SSH access rules","desc":"Each entry governs SSH sessions between tailnet nodes, with keys `action` (\"accept\" or \"check\"), `src`, `dst`, `users` (SSH login names allowed on the destination), `checkPeriod` (how long a check-mode authentication is honored), `recorder` (session-recording destinations), and `enforceRecorder` (whether a session is denied when no recorder is reachable).","provider":"go.mondoo.com/mql/providers/tailscale"},"tagOwners":{"name":"tagOwners","type":"\u001a\u0007\u0019\u0007","is_mandatory":true,"title":"Tag owners, the users or groups allowed to assign each ACL tag (tag to list of owners)","provider":"go.mondoo.com/mql/providers/tailscale"},"tailnet":{"name":"tailnet","type":"\u0007","is_mandatory":true,"title":"Tailnet name this ACL policy belongs to","provider":"go.mondoo.com/mql/providers/tailscale"},"tests":{"name":"tests","type":"\u0019\n","is_mandatory":true,"title":"Connectivity tests embedded in the policy","desc":"Each entry asserts expected access for a source, with keys `src` (or legacy `user`), `accept` (destinations that must be reachable), `deny` (destinations that must be blocked), and `allow` (legacy alias for accept). Tailscale evaluates these when the policy is saved.","provider":"go.mondoo.com/mql/providers/tailscale"}},"title":"Tailscale tailnet ACL (access control list) policy","desc":"The tailnet's parsed HuJSON ACL policy (https://tailscale.com/kb/1018/acls), which governs which users and devices can reach which others. Auditing this policy surfaces over-broad access rules, tag-owner assignments, Tailscale SSH grants, device-posture requirements, and exit-node or subnet-route auto-approvers. The `raw` field returns the source HuJSON for fall-through pattern matching the structured fields don't cover.","min_provider_version":"13.0.7","defaults":"tailnet","provider":"go.mondoo.com/mql/providers/tailscale"},"tailscale.authKey":{"id":"tailscale.authKey","name":"tailscale.authKey","fields":{"audience":{"name":"audience","type":"\u0007","is_mandatory":true,"title":"Audience the external identity provider must name in tokens presented by a federated identity","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the key was created","provider":"go.mondoo.com/mql/providers/tailscale"},"customClaimRules":{"name":"customClaimRules","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Additional claims an external identity provider's token must carry for a federated identity to be accepted (claim name to required value)","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description set when the key was created","provider":"go.mondoo.com/mql/providers/tailscale"},"ephemeral":{"name":"ephemeral","type":"\u0004","is_mandatory":true,"title":"Whether devices created with the key are ephemeral (auto-removed when offline)","provider":"go.mondoo.com/mql/providers/tailscale"},"expires":{"name":"expires","type":"\t","is_mandatory":true,"title":"Expiration time of the key","desc":"Null when the key never expires. A key with no expiration is the longest-lived credential the tailnet can hold, so absence here is the finding rather than the all-clear, and there is no date to compare against the current time. Use isExpired to test whether a key is past its expiration, and hasExpiration to find the keys that have no expiration at all.","provider":"go.mondoo.com/mql/providers/tailscale"},"hasExpiration":{"name":"hasExpiration","type":"\u0004","title":"Whether the key has an expiration set (false means the key never expires)","min_provider_version":"13.2.4","provider":"go.mondoo.com/mql/providers/tailscale"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Identifier of the key","provider":"go.mondoo.com/mql/providers/tailscale"},"invalid":{"name":"invalid","type":"\u0004","is_mandatory":true,"title":"Whether the key has been marked invalid (revoked or its tailnet was deleted)","provider":"go.mondoo.com/mql/providers/tailscale"},"isExpired":{"name":"isExpired","type":"\u0004","title":"Whether the key is past its expiration time","desc":"False for a key that never expires, since such a key is never past an expiration it does not have. Pair with hasExpiration to tell a key that is still within its window from one that has no window.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/tailscale"},"isRevoked":{"name":"isRevoked","type":"\u0004","title":"Whether the key has been revoked","min_provider_version":"13.2.4","provider":"go.mondoo.com/mql/providers/tailscale"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Issuer URL of the external identity provider trusted by a federated identity","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"keyType":{"name":"keyType","type":"\u0007","is_mandatory":true,"title":"Kind of credential this key represents","desc":"`client` for an OAuth client, `federated` for a federated identity, and empty or `auth` for a pre-auth key that onboards devices.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"preauthorized":{"name":"preauthorized","type":"\u0004","is_mandatory":true,"title":"Whether devices created with the key are pre-approved into a tailnet that requires device approval","provider":"go.mondoo.com/mql/providers/tailscale"},"reusable":{"name":"reusable","type":"\u0004","is_mandatory":true,"title":"Whether the key can be used to authenticate more than one device","provider":"go.mondoo.com/mql/providers/tailscale"},"revoked":{"name":"revoked","type":"\t","is_mandatory":true,"title":"Revocation time of the key","desc":"Null when the key has not been revoked.","provider":"go.mondoo.com/mql/providers/tailscale"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"API scopes granted to an OAuth client or federated identity","desc":"For example `devices:core:read` or `all:write`. Empty for pre-auth keys, which onboard devices rather than calling the API.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"subject":{"name":"subject","type":"\u0007","is_mandatory":true,"title":"Subject claim the external identity provider must assert for a federated identity to be accepted","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"ACL tags applied to devices that authenticate using this key","provider":"go.mondoo.com/mql/providers/tailscale"},"updated":{"name":"updated","type":"\t","is_mandatory":true,"title":"Time the key was last modified","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"user":{"name":"user","type":"\u001btailscale.user","title":"User account that owns the key","desc":"The account the credential was issued under. A long-lived credential outlives the session that created it, so pairing the key with its owner is what surfaces an OAuth client holding write scopes that belongs to a suspended or departed account. Null when the owning account is no longer present in the tailnet.","min_provider_version":"13.3.12","provider":"go.mondoo.com/mql/providers/tailscale"},"userId":{"name":"userId","type":"\u0007","is_mandatory":true,"title":"ID of the user that owns the key","desc":"Deprecated in favor of user, whose id carries the same value and which resolves the account itself.","provider":"go.mondoo.com/mql/providers/tailscale","maturity":"deprecated"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"Tailscale tailnet key","desc":"Single long-lived credential issued for the tailnet, selected by `id` (for example `tailscale.authKey(id: \"kXZ...\")`). The tailnet key list covers three kinds of credential, which `keyType` distinguishes: pre-auth keys that onboard devices without interactive sign-in, OAuth clients that call the Tailscale API, and federated identities that exchange an external IdP token for API access. Because all three are long-lived, the `expires` and `revoked` timestamps, the `invalid` flag, and the `reusable`, `ephemeral`, and `preauthorized` capability flags are the primary audit signals. `scopes` carries the API access an OAuth client or federated identity holds, where a client granted broad write scopes is effectively a tailnet administrator. `tags` lists the ACL tags any device enrolled with this credential will receive, where over-broad tagging is a common finding. The key material itself is never exposed; only the metadata is.","private":true,"min_provider_version":"13.1.8","defaults":"id keyType description expires revoked","provider":"go.mondoo.com/mql/providers/tailscale"},"tailscale.device":{"id":"tailscale.device","name":"tailscale.device","fields":{"addresses":{"name":"addresses","type":"\u0019\u0007","is_mandatory":true,"title":"List of Tailscale IP addresses for the device, including both IPv4 and IPv6 addresses","provider":"go.mondoo.com/mql/providers/tailscale"},"advertisedRoutes":{"name":"advertisedRoutes","type":"\u0019\u0007","is_mandatory":true,"title":"Subnet routes that the device is advertising","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"authorized":{"name":"authorized","type":"\u0004","is_mandatory":true,"title":"Whether the device is authorized to join the tailnet","provider":"go.mondoo.com/mql/providers/tailscale"},"blocksIncomingConnections":{"name":"blocksIncomingConnections","type":"\u0004","is_mandatory":true,"title":"Whether the device is blocked from accepting connections over Tailscale, including pings","provider":"go.mondoo.com/mql/providers/tailscale"},"clientVersion":{"name":"clientVersion","type":"\u0007","is_mandatory":true,"title":"Version of the Tailscale client software (empty for external devices)","provider":"go.mondoo.com/mql/providers/tailscale"},"connectedToControl":{"name":"connectedToControl","type":"\u0004","is_mandatory":true,"title":"Whether the device currently holds a connection to the Tailscale coordination server","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Date when the device was added to the tailnet","desc":"Null for devices Tailscale reports no creation date for, which includes external devices shared into the tailnet.","provider":"go.mondoo.com/mql/providers/tailscale"},"derpRelay":{"name":"derpRelay","type":"\u0007","is_mandatory":true,"title":"DERP relay the device falls back to when a direct connection cannot be established","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"distroCodeName":{"name":"distroCodeName","type":"\u0007","is_mandatory":true,"title":"Operating system distribution code name reported by the client, for example 'noble'","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"distroName":{"name":"distroName","type":"\u0007","is_mandatory":true,"title":"Operating system distribution name reported by the client, for example 'ubuntu' or 'debian'","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"distroVersion":{"name":"distroVersion","type":"\u0007","is_mandatory":true,"title":"Operating system distribution version reported by the client","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"enabledRoutes":{"name":"enabledRoutes","type":"\u0019\u0007","is_mandatory":true,"title":"Subnet routes that are enabled (allowed) for the device, its effective subnet scope","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"endpoints":{"name":"endpoints","type":"\u0019\u0007","is_mandatory":true,"title":"Public endpoints the client last advertised for direct connections, as host:port","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Expiration date of the device's key","desc":"Null when the key is set never to expire, which `keyExpiryDisabled` also reports. A comparison against this field therefore selects only devices whose key can expire.","provider":"go.mondoo.com/mql/providers/tailscale"},"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"Machine name in the admin console","provider":"go.mondoo.com/mql/providers/tailscale"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Legacy identifier for a device","provider":"go.mondoo.com/mql/providers/tailscale"},"isEphemeral":{"name":"isEphemeral","type":"\u0004","is_mandatory":true,"title":"Whether the device was registered with an ephemeral auth key and is removed automatically once it goes offline","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"isExternal":{"name":"isExternal","type":"\u0004","is_mandatory":true,"title":"Whether a device is shared into the tailnet (rather than a member of the tailnet)","provider":"go.mondoo.com/mql/providers/tailscale"},"keyExpiryDisabled":{"name":"keyExpiryDisabled","type":"\u0004","is_mandatory":true,"title":"Whether key expiration is disabled for the device","provider":"go.mondoo.com/mql/providers/tailscale"},"lastSeenAt":{"name":"lastSeenAt","type":"\t","is_mandatory":true,"title":"When device was last active on the tailnet","desc":"Null while the device holds a connection to the coordination server, because \"last seen\" has no meaning for a device that is seen right now. Pair with `connectedToControl` when auditing for dormant devices.","provider":"go.mondoo.com/mql/providers/tailscale"},"machineKey":{"name":"machineKey","type":"\u0007","is_mandatory":true,"title":"Machine key used by Tailscale (empty for external devices)","provider":"go.mondoo.com/mql/providers/tailscale"},"mappingVariesByDestIp":{"name":"mappingVariesByDestIp","type":"\u0004","is_mandatory":true,"title":"Whether the device's NAT maps it to a different external port per destination","desc":"True indicates hard or symmetric NAT, which prevents direct peer connections and forces traffic through a DERP relay.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"MagicDNS name of the device","provider":"go.mondoo.com/mql/providers/tailscale"},"nodeId":{"name":"nodeId","type":"\u0007","is_mandatory":true,"title":"Preferred identifier for a device","desc":"Tailscale's current device identifier, which supersedes the numeric `id`. Both address the same device through the API.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"nodeKey":{"name":"nodeKey","type":"\u0007","is_mandatory":true,"title":"Node key primarily used by Tailscale and required for select operations, such as adding a node to a locked tailnet","provider":"go.mondoo.com/mql/providers/tailscale"},"os":{"name":"os","type":"\u0007","is_mandatory":true,"title":"Operating system that the device is running","provider":"go.mondoo.com/mql/providers/tailscale"},"owner":{"name":"owner","type":"\u001btailscale.user","title":"User account that registered the device","desc":"The account the device is attributed to, which for an untagged device is also its owner. Resolving it turns a device inventory into an access review: the role, status, and lastSeenAt of the person behind each machine, so a suspended or long-idle account whose machines are still enrolled becomes a single query. Null for a tagged device and for a device shared in from another tailnet, neither of which is attributed to an account in this tailnet.","min_provider_version":"13.3.12","provider":"go.mondoo.com/mql/providers/tailscale"},"postureHardwareAddresses":{"name":"postureHardwareAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Hardware (MAC) addresses collected from the device","desc":"Populated only when posture identity collection is turned on for the tailnet.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"postureIdentityDisabled":{"name":"postureIdentityDisabled","type":"\u0004","is_mandatory":true,"title":"Whether posture identity collection is turned off for this specific device","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"postureSerialNumbers":{"name":"postureSerialNumbers","type":"\u0019\u0007","is_mandatory":true,"title":"Hardware serial numbers collected from the device","desc":"Populated only when posture identity collection is turned on for the tailnet, which `postureIdentityCollectionEnabled` on `tailscale` reports. Empty when collection is off or the client reported none.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"sshEnabled":{"name":"sshEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the device accepts Tailscale SSH sessions","desc":"A node with Tailscale SSH turned on serves SSH to any peer the ACL `ssh` rules permit, bypassing the host's own sshd and its authorized_keys. Combine with the `ssh` rules on `tailscale.aclPolicy` to see who can reach it.","min_provider_version":"13.3.11","provider":"go.mondoo.com/mql/providers/tailscale"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"An identity for the device that is separate from human users (used as part of an ACL to restrict access)","provider":"go.mondoo.com/mql/providers/tailscale"},"tailnetLockError":{"name":"tailnetLockError","type":"\u0007","is_mandatory":true,"title":"Issue with the tailnet lock node-key signature on this device (only populated when tailnet lock is enabled)","provider":"go.mondoo.com/mql/providers/tailscale"},"tailnetLockKey":{"name":"tailnetLockKey","type":"\u0007","is_mandatory":true,"title":"Node's tailnet lock key","provider":"go.mondoo.com/mql/providers/tailscale"},"updateAvailable":{"name":"updateAvailable","type":"\u0004","is_mandatory":true,"title":"Whether a Tailscale client version upgrade is available (empty for external devices)","provider":"go.mondoo.com/mql/providers/tailscale"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"Login name of the user who registered the device","desc":"Deprecated in favor of owner, whose loginName carries the same value and which resolves the account itself.","provider":"go.mondoo.com/mql/providers/tailscale","maturity":"deprecated"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"Tailscale device (also called a node or machine)","desc":"Single device registered in the tailnet, selected by `id`, for example `tailscale.device(id: \"12345\")`. Devices carry much of a tailnet's security posture: whether a node is `authorized` to join, whether it blocks incoming connections, whether key expiry is disabled, its ACL `tags`, its assigned Tailscale addresses, and its tailnet-lock signing state. The `advertisedRoutes` and `enabledRoutes` fields show which subnets the device offers to route and which of those have been approved, so you can audit for unapproved or overbroad subnet routing. `sshEnabled` reports whether the node accepts Tailscale SSH sessions, and `postureSerialNumbers` and `postureHardwareAddresses` carry the hardware identity the tailnet collects when posture identity collection is turned on.","min_provider_version":"11.0.0","defaults":"id hostname os","provider":"go.mondoo.com/mql/providers/tailscale"},"tailscale.logstream":{"id":"tailscale.logstream","name":"tailscale.logstream","fields":{"destinationType":{"name":"destinationType","type":"\u0007","is_mandatory":true,"title":"Destination service receiving the stream","desc":"One of `splunk`, `elastic`, `panther`, `cribl`, `datadog`, `axiom`, or `s3`.","provider":"go.mondoo.com/mql/providers/tailscale"},"logType":{"name":"logType","type":"\u0007","is_mandatory":true,"title":"Log feed this stream carries: `configuration` (audit log) or `network` (flow log)","provider":"go.mondoo.com/mql/providers/tailscale"},"s3AccessKeyId":{"name":"s3AccessKeyId","type":"\u0007","is_mandatory":true,"title":"Access key ID used when `s3AuthenticationType == \"accesskey\"`","provider":"go.mondoo.com/mql/providers/tailscale"},"s3AuthenticationType":{"name":"s3AuthenticationType","type":"\u0007","is_mandatory":true,"title":"S3 authentication mode (`accesskey` or `rolearn`)","provider":"go.mondoo.com/mql/providers/tailscale"},"s3Bucket":{"name":"s3Bucket","type":"\u0007","is_mandatory":true,"title":"S3 bucket name when `destinationType == \"s3\"`","provider":"go.mondoo.com/mql/providers/tailscale"},"s3ExternalId":{"name":"s3ExternalId","type":"\u0007","is_mandatory":true,"title":"External ID Tailscale must include when assuming the role","provider":"go.mondoo.com/mql/providers/tailscale"},"s3KeyPrefix":{"name":"s3KeyPrefix","type":"\u0007","is_mandatory":true,"title":"S3 key prefix prepended to written objects when `destinationType == \"s3\"`","provider":"go.mondoo.com/mql/providers/tailscale"},"s3Region":{"name":"s3Region","type":"\u0007","is_mandatory":true,"title":"S3 region when `destinationType == \"s3\"`","provider":"go.mondoo.com/mql/providers/tailscale"},"s3RoleArn":{"name":"s3RoleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the IAM role Tailscale assumes when `s3AuthenticationType == \"rolearn\"`","provider":"go.mondoo.com/mql/providers/tailscale"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Endpoint URL for HTTP destinations","provider":"go.mondoo.com/mql/providers/tailscale"},"user":{"name":"user","type":"\u0007","is_mandatory":true,"title":"Username for HTTP destinations that authenticate with basic credentials","provider":"go.mondoo.com/mql/providers/tailscale"}},"title":"Tailscale log stream destination","desc":"Configured log stream that forwards tailnet logs to an external destination. `logType` is `configuration` (admin audit log) or `network` (flow log). `destinationType` is one of `splunk`, `elastic`, `panther`, `cribl`, `datadog`, `axiom`, or `s3`. For HTTP sinks `url` and `user` carry the connection details; for S3 sinks `s3Bucket`, `s3Region`, `s3KeyPrefix`, and `s3AuthenticationType` (`accesskey` or `rolearn`) define the bucket and authentication mode, with `s3AccessKeyId` or `s3RoleArn` and `s3ExternalId` filled in accordingly. Tokens and S3 secret access keys are never returned by the Tailscale API and are not exposed here.","private":true,"min_provider_version":"13.1.8","defaults":"logType destinationType","provider":"go.mondoo.com/mql/providers/tailscale"},"tailscale.service":{"id":"tailscale.service","name":"tailscale.service","fields":{"addresses":{"name":"addresses","type":"\u0019\u0007","is_mandatory":true,"title":"Tailscale IP addresses assigned to the service, including both IPv4 and IPv6 addresses","provider":"go.mondoo.com/mql/providers/tailscale"},"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Arbitrary key/value annotations attached to the service","provider":"go.mondoo.com/mql/providers/tailscale"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Human-readable comment set when the service was defined","provider":"go.mondoo.com/mql/providers/tailscale"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the service, including the 'svc:' prefix","provider":"go.mondoo.com/mql/providers/tailscale"},"ports":{"name":"ports","type":"\u0019\u0007","is_mandatory":true,"title":"Protocol and port ranges the service accepts","desc":"Each entry is a protocol and port specification such as `tcp:443`, `udp:53`, or `tcp:8000-8080`. The value `*` accepts every port on every protocol.","provider":"go.mondoo.com/mql/providers/tailscale"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"ACL tags applied to the service","provider":"go.mondoo.com/mql/providers/tailscale"}},"init":{"args":[{"name":"name","type":"\u0007","optional":true}]},"title":"Tailscale service","desc":"Service published on the tailnet under its own Tailscale address rather than on a single node's address, selected by `name` (for example `tailscale.service(name: \"svc:web\")`). A service is reachable from any node the ACL permits, and the nodes backing it can change without the address changing. `ports` lists the protocol and port ranges the service accepts, where `tcp:*` or a wide range widens the reachable surface, and `tags` carries the ACL tags that decide which nodes may host it and which peers may reach it.","private":true,"min_provider_version":"13.3.11","defaults":"name ports","provider":"go.mondoo.com/mql/providers/tailscale"},"tailscale.user":{"id":"tailscale.user","name":"tailscale.user","fields":{"authKeys":{"name":"authKeys","type":"\u0019\u001btailscale.authKey","title":"Tailnet keys the user owns","desc":"Pre-auth keys, OAuth clients, and federated identities issued under this account. A credential outlives the session that created it, so an account that has left the tailnet can still own an unrevoked OAuth client with write scopes. Empty for an account that owns no credentials.","min_provider_version":"13.3.12","provider":"go.mondoo.com/mql/providers/tailscale"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the user joined the tailnet","provider":"go.mondoo.com/mql/providers/tailscale"},"currentlyConnected":{"name":"currentlyConnected","type":"\u0004","is_mandatory":true,"title":"Whether the user is currently connected to the tailnet","min_provider_version":"13.0.7","provider":"go.mondoo.com/mql/providers/tailscale"},"deviceCount":{"name":"deviceCount","type":"\u0005","is_mandatory":true,"title":"Number of devices the user owns","provider":"go.mondoo.com/mql/providers/tailscale"},"devices":{"name":"devices","type":"\u0019\u001btailscale.device","title":"Devices the user registered","desc":"The devices in the tailnet attributed to this account, which deviceCount reports only as a number. Reading the devices themselves is what turns an offboarding review into an answer: the machines a suspended account still has enrolled, whether any of them advertises a subnet route or an exit node, and when each was last seen. Empty for an account that registered nothing.","min_provider_version":"13.3.12","provider":"go.mondoo.com/mql/providers/tailscale"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Name of the user","provider":"go.mondoo.com/mql/providers/tailscale"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the user","provider":"go.mondoo.com/mql/providers/tailscale"},"lastSeenAt":{"name":"lastSeenAt","type":"\t","is_mandatory":true,"title":"Last time the user was active on the tailnet","desc":"Activity is either a node connection or authenticating to a Tailscale service, including the admin panel. Null when Tailscale reports no such time, so a query for dormant accounts selects only the accounts that have been seen at least once.","provider":"go.mondoo.com/mql/providers/tailscale"},"loginName":{"name":"loginName","type":"\u0007","is_mandatory":true,"title":"Email-like login name of the user","provider":"go.mondoo.com/mql/providers/tailscale"},"profilePicUrl":{"name":"profilePicUrl","type":"\u0007","is_mandatory":true,"title":"Profile picture URL for the user","provider":"go.mondoo.com/mql/providers/tailscale"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Role of the user (owner, member, admin, etc.)","provider":"go.mondoo.com/mql/providers/tailscale"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the user","desc":"'active' - Last seen within 28 days 'idle' - Last seen more than 28 days ago 'suspended' - Suspended from accessing the tailnet 'needs-approval' - Unable to join tailnet until approved 'over-billing-limit' - Unable to join tailnet until billing count increased","provider":"go.mondoo.com/mql/providers/tailscale"},"tailnetId":{"name":"tailnetId","type":"\u0007","is_mandatory":true,"title":"Tailnet that owns the user","provider":"go.mondoo.com/mql/providers/tailscale"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type of relation this user has to the tailnet (member or shared)","provider":"go.mondoo.com/mql/providers/tailscale"}},"init":{"args":[{"name":"id","type":"\u0007","optional":true}]},"title":"Tailscale user","desc":"Single user account known to the tailnet, selected by `id` (for example `tailscale.user(id: \"uid-abc123\")`). Covers the display name, login name, profile picture, owning tailnet, relation type (member or shared), assigned role (owner, admin, member, and other roles), account status (active, idle, suspended, needs-approval, or over-billing-limit), the count of devices the user owns, join and last-seen timestamps, and whether the account is currently connected. Supports access reviews and dormant or suspended-account hygiene.","min_provider_version":"11.0.0","defaults":"id displayName type","provider":"go.mondoo.com/mql/providers/tailscale"},"tailscale.webhook":{"id":"tailscale.webhook","name":"tailscale.webhook","fields":{"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the endpoint was registered","provider":"go.mondoo.com/mql/providers/tailscale"},"creator":{"name":"creator","type":"\u001btailscale.user","title":"User account that registered the endpoint","desc":"The account behind creatorLoginName, which is what tells an audit whether the person routing tailnet events off-platform is still an active member and what role they hold. Null when the creator has since left the tailnet, in which case creatorLoginName is the only remaining record.","min_provider_version":"13.3.12","provider":"go.mondoo.com/mql/providers/tailscale"},"creatorLoginName":{"name":"creatorLoginName","type":"\u0007","is_mandatory":true,"title":"Login name of the user that registered the endpoint","desc":"Retained alongside creator because Tailscale keeps reporting the login name after the account leaves the tailnet, at which point it is the only surviving record of who registered the endpoint.","provider":"go.mondoo.com/mql/providers/tailscale"},"endpointId":{"name":"endpointId","type":"\u0007","is_mandatory":true,"title":"Identifier of the webhook endpoint","provider":"go.mondoo.com/mql/providers/tailscale"},"endpointUrl":{"name":"endpointUrl","type":"\u0007","is_mandatory":true,"title":"URL events are POSTed to","provider":"go.mondoo.com/mql/providers/tailscale"},"lastModified":{"name":"lastModified","type":"\t","is_mandatory":true,"title":"Time the endpoint subscription was last modified","desc":"Null when Tailscale reports no such time.","provider":"go.mondoo.com/mql/providers/tailscale"},"providerType":{"name":"providerType","type":"\u0007","is_mandatory":true,"title":"Receiver shape (`slack`, `mattermost`, `googlechat`, `discord`, or empty for the generic Tailscale format)","provider":"go.mondoo.com/mql/providers/tailscale"},"subscriptions":{"name":"subscriptions","type":"\u0019\u0007","is_mandatory":true,"title":"Events the endpoint is subscribed to","desc":"Individual events such as `nodeCreated`, `nodeNeedsApproval`, `nodeApproved`, `nodeKeyExpiringInOneDay`, `nodeKeyExpired`, `nodeDeleted`, `policyUpdate`, `userCreated`, `userNeedsApproval`, `userSuspended`, `userRestored`, `userDeleted`, `userApproved`, `userRoleUpdated`, `subnetIPForwardingNotEnabled`, `exitNodeIPForwardingNotEnabled`. Umbrella categories `categoryTailnetManagement` and `categoryDeviceMisconfigurations` subscribe to every event in their group, including future additions.","provider":"go.mondoo.com/mql/providers/tailscale"}},"init":{"args":[{"name":"endpointId","type":"\u0007","optional":true}]},"title":"Tailscale webhook endpoint","desc":"Webhook endpoint subscribed to tailnet events, selected by `endpointId` (for example `tailscale.webhook(endpointId: \"whep-abc123CNTRL\")`). Auditing these endpoints surfaces where tailnet activity is routed off-platform and who registered each receiver. `providerType` distinguishes the receiver shape: `slack`, `mattermost`, `googlechat`, `discord`, or empty for a generic Tailscale-formatted POST. `subscriptions` lists the events the endpoint receives (for example `nodeNeedsApproval`, `userSuspended`, `policyUpdate`, or the umbrella `categoryTailnetManagement` / `categoryDeviceMisconfigurations`). `creatorLoginName` is the user that registered the endpoint. The shared HMAC secret is never exposed.","private":true,"min_provider_version":"13.1.8","defaults":"endpointId providerType endpointUrl","provider":"go.mondoo.com/mql/providers/tailscale"}},"dependencies":{"core":{"id":"go.mondoo.com/mql/providers/core","name":"core"}},"provider_roots":{"go.mondoo.com/mql/providers/tailscale":"tailscale"}}