Tor Exit Node Connection
High
Investigating
ALR-00103 · 2026-07-10T15:28:36Z
Description
Connection from SW-CORE-01 to known Tor exit node detected by Cloud Connector. User 'k.brown' was active at the time.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
15:28:36
Event ingested by SOC365 Engine
15:28:37
EmilyAI triage started — correlation enrichment
15:28:46
EmilyAI confidence: 88% — escalated to human analyst
15:29:19
Alert assigned to analyst: James Okonkwo
15:29:56
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00225 | 4h ago | Tor Exit Node Connection | High | Open | SW-CORE-01 |
| ALR-00056 | 4h ago | Certificate Anomaly | Informational | Escalated | SW-CORE-01 |
| ALR-00433 | 5h ago | Tor Exit Node Connection | Informational | Investigating | WS-PC-001 |
| ALR-00008 | 8h ago | Unauthorised USB Device | Low | Investigating | SW-CORE-01 |
| ALR-00434 | 12h ago | Malware Signature Match | Medium | Open | SW-CORE-01 |