Slack alerts and an audit log for every new Tailscale device

Run this workflow from a Tailscale webhook. In the Tailscale admin console, create a webhook endpoint pointing at this workflow and subscribe it to the Tailnet Management events nodeNeedsApproval (a node needs approval) and nodeCreated (a node was created). Tailscale delivers these within a few seconds of the event occurring. A single delivery can contain more than one event, so treat the payload as a list and process every event in it.

For each event, read the device or node identifier out of the event payload and call the Tailscale Get a device operation to load the full device record. From that record pick up the device name, the owner (the user the device belongs to), the operating system, the tags applied to it, the addresses it was assigned, and the time it was created.

Post one message per event to a Slack security channel using the Slack Bot Send a Message operation. Format it so a reader can tell at a glance who is asking, from what machine, and when. Lead with whether this is a device waiting for approval or simply a new device that joined, then list the device name, the owner, the operating system, the tags, and the assigned addresses, and finish with the event timestamp. Use Slack mrkdwn formatting (single asterisks for bold) and keep the field labels consistent so the messages are easy to scan in a busy channel.

In the same run, append one row per event to a Google Sheets device approval log using the Append Values operation. The columns are the event timestamp, the device name, the owner, the operating system, the tags, and the event type (nodeNeedsApproval or nodeCreated). Append rather than overwrite, so the sheet builds a permanent history of every join request whether or not it was ever approved.

Build this as a code workflow: every step is deterministic, with one event in, one enrichment lookup, one fixed-format message, and one appended row. Note that device approval is an opt-in Tailscale setting. Tailnets with it enabled will see nodeNeedsApproval events for machines waiting in the queue, while tailnets without it will only ever see nodeCreated, which still gives useful visibility of every new machine joining the network. Make the workflow tolerant of a device lookup that fails or returns partial data: still post the alert and still write the log row using whatever the event payload itself provided, so a lookup error never causes a join request to go unrecorded.