Tor Exit Node Connection
Low
Investigating
ALR-00261 · 2026-07-10T17:29:05Z
Description
Connection from WS-LAP-011 to known Tor exit node detected by DecoyPulse. User 'p.thomas' was active at the time.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:29:05
Event ingested by SOC365 Engine
17:29:08
EmilyAI triage started — correlation enrichment
17:29:16
EmilyAI confidence: 82% — escalated to human analyst
17:29:42
Alert assigned to analyst: EmilyAI (auto)
17:30:34
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00069 | 3h ago | Malware Signature Match | Medium | Open | WS-LAP-011 |
| ALR-00168 | 5h ago | Pass-the-Hash Detected | Medium | Investigating | WS-LAP-011 |
| ALR-00371 | 6h ago | Tor Exit Node Connection | Medium | Escalated | WS-LAP-010 |
| ALR-00279 | 6h ago | Suspicious Scheduled Task | Low | False Positive | WS-LAP-011 |
| ALR-00202 | 10h ago | Tor Exit Node Connection | Medium | Escalated | SRV-BACKUP-01 |