Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:43:01 UTC

Tor Exit Node Connection

Low False Positive
ALR-00092 · 2026-10-08T23:15:25Z

Description

Connection from WS-LAP-010 to known Tor exit node detected by Email Gateway. User 'e.evans' was active at the time.

Alert Metadata

Alert ID
ALR-00092
Timestamp
2026-10-08T23:15:25Z
Severity
Low
Status
False Positive
Detection Source
Email Gateway
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-010
User Account
e.evans
Source IP
185.240.220.157
Destination IP
10.2.132.37
Origin Country
RO Romania

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

23:15:25 Event ingested by SOC365 Engine
23:15:29 EmilyAI triage started — correlation enrichment
23:15:40 EmilyAI confidence: 93% — escalated to human analyst
23:15:56 Alert assigned to analyst: EmilyAI (auto)
23:18:10 Investigation started — querying SIEM and threat intelligence
23:18:33 Containment action taken — endpoint isolated
23:32:33 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00444 7h ago Suspicious Scheduled Task Low Investigating WS-LAP-010
ALR-00061 9h ago Tor Exit Node Connection Medium Investigating VM-DEV-01
ALR-00428 17h ago Unusual Outbound Traffic High Open WS-LAP-010
ALR-00094 18h ago Tor Exit Node Connection Medium Resolved WS-PC-004
ALR-00465 19h ago Suspicious PowerShell Execution Medium False Positive WS-LAP-010