Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:45:09 UTC

Tor Exit Node Connection

High Open
ALR-00055 · 2026-10-09T13:07:34Z

Description

Connection from WS-PC-004 to known Tor exit node detected by Attack Surface Scanner. User 'n.clark' was active at the time.

Alert Metadata

Alert ID
ALR-00055
Timestamp
2026-10-09T13:07:34Z
Severity
High
Status
Open
Detection Source
Attack Surface Scanner
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
WS-PC-004
User Account
n.clark
Source IP
185.140.220.118
Destination IP
10.0.179.102
Origin Country
US United States

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

13:07:34 Event ingested by SOC365 Engine
13:07:39 EmilyAI triage started — correlation enrichment
13:07:42 EmilyAI confidence: 82% — escalated to human analyst
13:08:13 Alert assigned to analyst: James Okonkwo
13:09:11 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00182 2h ago Failed MFA Challenge Medium Resolved WS-PC-004
ALR-00138 3h ago Unauthorised USB Device Low Open WS-PC-004
ALR-00339 8h ago Tor Exit Node Connection Medium Investigating SRV-APP-01
ALR-00320 17h ago Tor Exit Node Connection High Investigating SRV-DC-01
ALR-00223 21h ago Tor Exit Node Connection Medium Open FW-EDGE-01