INTEGRATION

Tailscale

Enriching OT and IT asset visibility in Nozomi Vantage with mesh-VPN device inventory and tag data from Tailscale.

About
Tailscale

Tailscale is a mesh VPN platform providing secure network connectivity, device identity management and zero-config networking across distributed infrastructure. By integrating Tailscale with Nozomi Vantage, security teams gain a consolidated view of managed assets across IT and OT environments — importing mesh-VPN device inventory and tag data directly into Vantage. This enriches the asset registry with authoritative data from the Tailscale management plane, accelerating incident investigation, reducing blind spots in critical infrastructure environments and enabling analysts to correlate sse telemetry with OT network observations without switching consoles.

Features

Importer Data Types

Vantage imports the following from
Tailscale
:
  • Asset Details Enrichment and Create New in Vantage

    Tailscale supplies records including machine hostname, Tailscale IPv4/IPv6, OS, client version, user identity, tags and last-seen timestamp — to enrich existing Vantage assets and create new asset records for endpoints not yet observed on the OT network.

Joint Use Cases

  • Correlating Tailscale signals with OT network alerts

    When Nozomi Vantage raises an anomaly alert for a device inside an OT segment, the analyst can pivot to the same asset's Tailscale record in Vantage to review recent policy decisions, posture state and connection telemetry, all without leaving the Vantage investigation workflow. This cross-layer correlation surfaces whether a network-layer anomaly coincides with activity observed by Tailscale, reducing the time needed to confirm or dismiss an incident.

  • Closing asset inventory gaps across IT and OT

    Devices recorded by Tailscale but not yet observed by Nozomi network sensors are automatically created as new asset records in Vantage, populated with device name, OS, posture state and user/identity context drawn from the Tailscale management plane. OT operations teams can audit the resulting unified inventory to identify unmonitored or underprotected assets in industrial and critical infrastructure zones, then prioritize sensor deployment accordingly.

  • Validating zero-trust enforcement on OT-adjacent endpoints

    Endpoints recorded by Tailscale as policy-managed are reconciled with assets observed crossing into OT-adjacent network zones in Vantage. Operations teams can verify that every device touching the OT boundary is enrolled in the zero-trust access platform, surfacing unmanaged or stale clients that should be remediated before further OT exposure.

Integration Prerequesites

  • Active Nozomi Vantage tenant with the connector-configuration role assigned to the administering account
  • Tailscale tailnet with an API access token issued under Settings → Keys with Devices: Read scope
  • Consistent hostname, IP or MAC addressing between Tailscale-recorded assets and Vantage-observed assets to enable accurate asset correlation and deduplication
  • Outbound network connectivity from Vantage to the source-tool API endpoint over HTTPS (this prerequisite is a deployment placeholder and may be adjusted to match your environment)
  • Outbound network connectivity from Vantage to the source-tool API endpoint over HTTPS (this prerequisite is a deployment placeholder and may be adjusted to match your environment)

Take the next step.

Discover how easy it is to identify and respond to cyber threats by automating your OT and IoT asset discovery, inventory, and management.