Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 18:42:38 UTC

Tor Exit Node Connection

Low Resolved
ALR-00027 · 2026-07-10T05:49:09Z

Description

Connection from WS-LAP-011 to known Tor exit node detected by SOC365 Engine. User 'h.roberts' was active at the time.

Alert Metadata

Alert ID
ALR-00027
Timestamp
2026-07-10T05:49:09Z
Severity
Low
Status
Resolved
Detection Source
SOC365 Engine
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-011
User Account
h.roberts
Source IP
45.202.148.250
Destination IP
10.3.57.155
Origin Country
IN India

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

05:49:09 Event ingested by SOC365 Engine
05:49:11 EmilyAI triage started — correlation enrichment
05:49:18 EmilyAI confidence: 88% — escalated to human analyst
05:49:43 Alert assigned to analyst: EmilyAI (auto)
05:51:38 Investigation started — querying SIEM and threat intelligence
05:52:36 Containment action taken — endpoint isolated
06:03:07 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00303 1h ago Insider Threat Indicator Medium Open WS-LAP-011
ALR-00058 4h ago Phishing Email Blocked Low Escalated WS-LAP-011
ALR-00108 4h ago Failed MFA Challenge Medium Resolved WS-LAP-011
ALR-00232 5h ago Privilege Escalation Attempt Low Escalated WS-LAP-011
ALR-00442 7h ago Tor Exit Node Connection Low Investigating SRV-DC-01