Tor Exit Node Connection
Informational
False Positive
ALR-00186 · 2026-07-06T06:19:42Z
Description
Connection from WS-PC-006 to known Tor exit node detected by SOC365 Engine. User 'a.wilson' was active at the time.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
06:19:42
Event ingested by SOC365 Engine
06:19:45
EmilyAI triage started — correlation enrichment
06:19:48
EmilyAI confidence: 80% — escalated to human analyst
06:20:06
Alert assigned to analyst: EmilyAI (auto)
06:22:29
Investigation started — querying SIEM and threat intelligence
06:24:10
Containment action taken — endpoint isolated
06:37:00
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00433 | 3h ago | Tor Exit Node Connection | High | Investigating | SW-CORE-01 |
| ALR-00169 | 10h ago | Tor Exit Node Connection | Medium | False Positive | WS-LAP-011 |
| ALR-00053 | 16h ago | Tor Exit Node Connection | Medium | Escalated | SRV-SQL-01 |
| ALR-00187 | 1d ago | Tor Exit Node Connection | Low | Resolved | WS-MAC-005 |
| ALR-00130 | 1d ago | Tor Exit Node Connection | Medium | Escalated | SRV-DC-01 |