Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:43:50 UTC

Tor Exit Node Connection

Medium Resolved
ALR-00210 · 2026-10-10T08:14:05Z

Description

Connection from WS-PC-002 to known Tor exit node detected by Endpoint Agent. User 'd.walker' was active at the time.

Alert Metadata

Alert ID
ALR-00210
Timestamp
2026-10-10T08:14:05Z
Severity
Medium
Status
Resolved
Detection Source
Endpoint Agent
Assigned Analyst
Emma Richardson

Endpoint Information

Hostname
WS-PC-002
User Account
d.walker
Source IP
45.168.148.83
Destination IP
10.0.253.86
Origin Country
IN India

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

08:14:05 Event ingested by SOC365 Engine
08:14:10 EmilyAI triage started — correlation enrichment
08:14:13 EmilyAI confidence: 86% — escalated to human analyst
08:14:27 Alert assigned to analyst: Emma Richardson
08:16:42 Investigation started — querying SIEM and threat intelligence
08:17:15 Containment action taken — endpoint isolated
08:29:09 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00050 33m ago Tor Exit Node Connection High Investigating WS-LAP-012
ALR-00350 1h ago Data Exfiltration Attempt Informational Investigating WS-PC-002
ALR-00428 4h ago Unauthorised USB Device Low Investigating WS-PC-002
ALR-00144 8h ago Lateral Movement Detected Low False Positive WS-PC-002
ALR-00498 8h ago Unauthorised USB Device Medium False Positive WS-PC-002