Skip to main content
All Tailscale integration capabilities

​
About

Stream your tailnet’s logs into Sazabi with Tailscale log streaming. Two log types are supported:
  • Configuration audit logs (Tailscale docs) record changes made in the admin console, API, or Terraform: who acted, which action they took, what it changed, and the old and new values.
  • Network flow logs (Tailscale docs) record, for each node and logging window, the virtual, subnet, exit, and physical traffic it sent and received.
Tailscale sends each log type to one destination, so each log type needs its own Sazabi log source and intake URL.

​
Prerequisites

  • A Tailscale Premium or Enterprise plan. Log streaming isn’t available on other plans.
  • The Owner, Admin, Network admin, or IT admin role in your tailnet.
  • For network flow logs, Network flow logs turned on under Logs in the Tailscale admin console.
  • One Sazabi log source per log type you want to send. Copy each source’s Intake URL from its setup screen.
Tailscale allows one streaming destination per log type. If a log type already streams to another SIEM, starting a stream to Sazabi means replacing that destination.

​
Set up in the dashboard

Repeat these steps for each log type, using a different Sazabi intake URL each time:
  1. In the Tailscale admin console, open Logs, then Configuration logs or Network flow logs.
  2. Select Start streaming.
  3. Choose Panther as the destination.
  4. Paste your Sazabi intake URL (shown above) as the URL.
  5. Enter any non-empty value as the Token. Sazabi authenticates with the public key in the URL’s hostname, so the token isn’t checked.
  6. Select Start streaming.

​
Set up with the CLI

You can also create the log sources with the Sazabi CLI (installed and authenticated; see CLI reference). Run the command once per log type:
The command prints the intake URL for the new source. Paste the whole URL into Tailscale using the steps above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint.

​
Verify

Make a harmless change in the Tailscale admin console, such as renaming a device. Within a few minutes, open the Intake page in the Sazabi dashboard and confirm events from the Tailscale source appear. Configuration audit records carry tailscale.action and tailscale.actor.login_name; network flow records carry tailscale.node_id. Tailscale doesn’t send a severity, so records have none.

​
Troubleshooting

Nothing arrives — Confirm the admin console shows the stream as active, the destination is Panther, and the URL is the full intake URL with no path added. No network flow logs — Network flow logs must be turned on for the tailnet before Tailscale has anything to stream. Flow fields look wrong — Every network flow field except the node ID is reported by the node itself, so treat those values as the node’s own claims.

​
Further reading

Intake

See per-source ingestion volume and health.

Webhook Events

Store arbitrary JSON webhook events as searchable log records.

Log sources

Browse the full log source catalog.