Tor Exit Node Connection
Medium
False Positive
ALR-00169 · 2026-07-11T10:32:03Z
Description
Connection from WS-LAP-011 to known Tor exit node detected by DLP Module. User 'd.walker' was active at the time.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
10:32:03
Event ingested by SOC365 Engine
10:32:04
EmilyAI triage started — correlation enrichment
10:32:12
EmilyAI confidence: 98% — escalated to human analyst
10:32:31
Alert assigned to analyst: James Okonkwo
10:34:19
Investigation started — querying SIEM and threat intelligence
10:38:01
Containment action taken — endpoint isolated
10:47:23
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00433 | 3h ago | Tor Exit Node Connection | High | Investigating | SW-CORE-01 |
| ALR-00467 | 8h ago | Privilege Escalation Attempt | High | Investigating | WS-LAP-011 |
| ALR-00053 | 16h ago | Tor Exit Node Connection | Medium | Escalated | SRV-SQL-01 |
| ALR-00405 | 23h ago | Failed MFA Challenge | Informational | Resolved | WS-LAP-011 |
| ALR-00093 | 1d ago | DLP Policy Violation | High | Escalated | WS-LAP-011 |