Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:42:40 UTC

Tor Exit Node Connection

Informational Investigating
ALR-00179 · 2026-10-07T17:12:31Z

Description

Connection from WS-LAP-011 to known Tor exit node detected by EmilyAI Triage. User 'k.brown' was active at the time.

Alert Metadata

Alert ID
ALR-00179
Timestamp
2026-10-07T17:12:31Z
Severity
Informational
Status
Investigating
Detection Source
EmilyAI Triage
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-011
User Account
k.brown
Source IP
45.217.148.60
Destination IP
10.2.113.15
Origin Country
IR Iran

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

17:12:31 Event ingested by SOC365 Engine
17:12:33 EmilyAI triage started — correlation enrichment
17:12:37 EmilyAI confidence: 97% — escalated to human analyst
17:13:15 Alert assigned to analyst: EmilyAI (auto)
17:14:33 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00415 1h ago Tor Exit Node Connection Medium False Positive FW-EDGE-01
ALR-00401 2h ago Suspicious Scheduled Task Medium False Positive WS-LAP-011
ALR-00462 6h ago Suspicious Scheduled Task Medium Open WS-LAP-011
ALR-00109 7h ago Failed MFA Challenge Medium False Positive WS-LAP-011
ALR-00424 15h ago Insider Threat Indicator Low Open WS-LAP-011