Scenario 6: Local Status and Policy Attack Paths

Local ingestion is where TailscaleHound can be useful even without control-plane credentials. Suppose you have tailscale status --json output from a joined workstation and a copy of the tailnet’s Access Policy. Status tells you which devices, users, external devices, tags, routes, and exit node options are visible from that host. The policy file tells you how ACLs, grants, SSH rules, posture, node attributes, host aliases, and ipsets are intended to work. TailscaleHound combines those into one graph.

One useful question is whether a local tagged device is not just present, but is itself a policy source that receives access to another device: MATCH p=(src:TS_Device)-[:TS_HasTag]->(tag:TS_Tag)-[:TS_GrantSource|TS_AclSource]->(rule)-[:TS_GrantTargetsDevice|TS_AclTargetsDevice]->(dst:TS_Device) RETURN p That path can highlight scenarios like a lab box, app server, or automation host carrying a tag that the Access Policy trusts. If an operator has code execution on that tagged device, the graph can show which hosts the device may be able to reach because of its tag.