Remove tailscale selectors

panther-labs · Dec 14, 2023 · edd6f6b · edd6f6b
1 parent fbabd1c
commit edd6f6b
Show file tree

Hide file tree

Showing 10 changed files with 0 additions and 100 deletions.
diff --git a/lookup_tables/greynoise/advanced/noise_advanced.yml b/lookup_tables/greynoise/advanced/noise_advanced.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/greynoise/advanced/riot_advanced.yml b/lookup_tables/greynoise/advanced/riot_advanced.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/greynoise/basic/noise_basic.yml b/lookup_tables/greynoise/basic/noise_basic.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_asn.yml b/lookup_tables/ipinfo/ipinfo_asn.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_asn_datalake.yml b/lookup_tables/ipinfo/ipinfo_asn_datalake.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_location.yml b/lookup_tables/ipinfo/ipinfo_location.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_location_datalake.yml b/lookup_tables/ipinfo/ipinfo_location_datalake.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_privacy.yml b/lookup_tables/ipinfo/ipinfo_privacy.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/ipinfo/ipinfo_privacy_datalake.yml b/lookup_tables/ipinfo/ipinfo_privacy_datalake.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"

diff --git a/lookup_tables/tor/tor_exit_nodes.yml b/lookup_tables/tor/tor_exit_nodes.yml
@@ -422,16 +422,6 @@ LogTypeMap:
     - LogType: Sysdig.Audit
       Selectors:
         - "$.content.userOriginIP"
-    - LogType: Tailscale.Network
-      Selectors:
-        - "$.event.virtualTraffic[].srcIp"
-        - "$.event.virtualTraffic[].dstIp"
-        - "$.event.subnetTraffic[].srcIp"
-        - "$.event.subnetTraffic[].dstIp"
-        - "$.event.exitTraffic[].srcIp"
-        - "$.event.exitTraffic[].dstIp"
-        - "$.event.physicalTraffic[].srcIp"
-        - "$.event.physicalTraffic[].dstIp"
     - LogType: Tines.Audit
       Selectors:
         - "request_ip"