Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 18:42:07 UTC

Tor Exit Node Connection

High Investigating
ALR-00050 · 2026-07-09T23:10:07Z

Description

Connection from FW-EDGE-01 to known Tor exit node detected by DecoyPulse. User 'a.wilson' was active at the time.

Alert Metadata

Alert ID
ALR-00050
Timestamp
2026-07-09T23:10:07Z
Severity
High
Status
Investigating
Detection Source
DecoyPulse
Assigned Analyst
Anika Patel

Endpoint Information

Hostname
FW-EDGE-01
User Account
a.wilson
Source IP
45.75.148.244
Destination IP
10.1.27.130
Origin Country
RU Russia

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

23:10:07 Event ingested by SOC365 Engine
23:10:12 EmilyAI triage started — correlation enrichment
23:10:21 EmilyAI confidence: 97% — escalated to human analyst
23:10:39 Alert assigned to analyst: Anika Patel
23:11:42 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00205 1h ago Brute Force SSH Medium Escalated FW-EDGE-01
ALR-00434 3h ago DecoyPulse Honeypot Triggered Low False Positive FW-EDGE-01
ALR-00442 7h ago Tor Exit Node Connection Low Investigating SRV-DC-01
ALR-00281 14h ago Malware Signature Match Low Investigating FW-EDGE-01
ALR-00086 15h ago Tor Exit Node Connection Low Open SRV-FILE-01