Tailscale
Tailscale is a modern, zero-configuration virtual private network (VPN) and secure networking platform that creates encrypted mesh networks (called tailnets) to connect devices, servers, and infrastructure across any network. Built on WireGuard, Tailscale enables secure peer-to-peer connectivity without complex firewall rules or traditional VPN server setup.
| Category | Network security |
| Direction | Query source |
| Sign-in | API Key |
| Query languages | SQLite |
| Tables | 7 |
| Query templates | 30 |
| Website | tailscale.com |
Before you start
Huntbase signs in to Tailscale with API Key. Create the credential in Tailscale first, then keep it to hand for the Connect step.
- Sign in to the Tailscale admin console as an Owner, Admin, IT admin or Network admin, and open the Keys page at https://console.tailscale.com/admin/settings/keys.
- Generate an API access token and choose an expiry between 1 and 90 days.
- Copy the token. Tokens are case-sensitive.
- Access tokens expire after the number of days you chose. Generate a new token and update the connection before then.
- An access token has full permission to the Tailscale API.
For the vendor's own instructions, see Tailscale API documentation.
Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.
Connect Tailscale
- Go to Connections and click New connection, or click New connection on the Tailscale product page.
- On Product, pick Tailscale and choose the Owner.
- On Details, give the connection a Name and, optionally, a Description.
- On Connect, fill in the settings and credentials described below.
- On Verify, review the summary and click Create & check.
For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.
Settings
Where your Tailscale lives:
| Field | Required | Notes |
|---|---|---|
| Tailnet Name | Yes | Your Tailnet ID, found on the General page of the admin console. Older tailnets may use the Legacy ID instead, such as example.com. |
Credentials
The only Method is API Key. Enter a Credential label (for example Production), then fill in:
| Field | Required | Notes |
|---|---|---|
| API Key | Yes | Secret — not shown again after you save it. |
Query it
Once connected, Tailscale can serve these languages in a query tab, and Scout can use it when you ask in Auto:
| Language | Use it for |
|---|---|
| SQLite | SQL over the 7 tables listed below, alongside every other connected source. |
Example: SQLite
Tailscale routes basic info — List routes being used, identifying exit nodes and associated network names to understand network traffic flow and potential bottlenecks.
SELECT * FROM tailscale_device_route;
Tailscale ships with 30 query templates. Find them in Library › Queries — see Query templates.
What syncs automatically
Tailscale comes with a content pack. These queries run on a schedule on each new connection so the entities they find appear in the Activity Feed without you asking. You can turn syncing off from the connection's Synchronisation Settings card.
| Query | Finds |
|---|---|
| Sync devices | device, user |
| Sync tailnet members | device, user |
| Sync outdated client posture | device, os, user |
Tables
Tailscale adds 7 tables. Browse their columns from Schema in the query bar's ⋯ menu.
All 7 tables
| Table | Contains |
|---|---|
tailscale_acl_auto_approver | Tailscale ACL Auto Approvers. |
tailscale_acl_derp_map | Tailscale ACL DERP Map. |
tailscale_acl_entry | Tailscale ACL entry. |
tailscale_acl_ssh | Tailscale Acl SSH. |
tailscale_device | A Tailscale Device represents the devices under a tailnet. |
tailscale_tailnet | Tailscale Tailnet. |
tailscale_tailnet_key | A Tailscale tailnet key represents the keys for a tailnet. |
Next steps
- Connections — health, credentials and settings after you connect
- Query languages — syntax, parameters and time ranges
- Chatting with Scout — ask questions without writing a query
- All integrations — the rest of the catalog