Tor Exit Node Connection
Low
Open
ALR-00253 · 2026-07-08T12:26:08Z
Description
Connection from SRV-WEB-01 to known Tor exit node detected by Attack Surface Scanner. User 'j.smith' was active at the time.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
12:26:08
Event ingested by SOC365 Engine
12:26:09
EmilyAI triage started — correlation enrichment
12:26:19
EmilyAI confidence: 87% — escalated to human analyst
12:26:53
Alert assigned to analyst: EmilyAI (auto)
12:27:40
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00213 | 15m ago | Tor Exit Node Connection | Informational | Escalated | SW-CORE-01 |
| ALR-00038 | 15m ago | Tor Exit Node Connection | Medium | False Positive | SRV-MAIL-01 |
| ALR-00363 | 1h ago | Tor Exit Node Connection | High | Open | WS-PC-004 |
| ALR-00385 | 5h ago | Shadow IT Discovery | Low | Escalated | SRV-WEB-01 |
| ALR-00136 | 10h ago | Tor Exit Node Connection | Medium | Escalated | WS-PC-004 |