Network / Network flow
Tailscale_Network_CL
Tailscale network session activity normalized for traffic investigation
Recommendation
High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations.
How the matrix worksC5 Network activity
Network activity: firewall, DNS, DHCP, web proxy, flow, load balancer, mail gateway and message flow, web access to internet-facing services
ACSC
- 2. Network device logs
- 8. Cloud platform logging
- 12. Windows DNS server analytic event logs
CISA
- 3. Network device infrastructure3a-3c DNS query and response, DHCP lease information, and firewall logs
MITRE data sources
None recorded
T3 High-volume aggregation
Primary, high or very-high volume, and the generic detection use is aggregation, threat-intelligence matching, baselining, or investigation.
Lake supported in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
TimeGenerated15SrcUser10SrcNodeName9Src8Dst5NodeId5Proto5SrcOs5SrcTags5DstNodeName4FirstFlow4Flows4
Sources for this recommendation
- Azure-Sentinel public content corpus Table identity and usage evidence from public analytics rules, hunting queries, parsers, and solution content. Classification, tier, retention, and billing recommendations require human review.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.