Tailscale SSH configuration changes via set/up --ssh by unexpected parent
Detects execution of the Tailscale CLI enabling or disabling Tailscale SSH using the set or up commands with the --ssh parameter, excluding known administrative tools.
Microsoft Sentinel (KQL)

