Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:50:22 UTC

Tor Exit Node Connection

Medium Investigating
ALR-00277 · 2026-10-07T05:41:52Z

Description

Connection from SW-CORE-01 to known Tor exit node detected by Firewall. User 'c.williams' was active at the time.

Alert Metadata

Alert ID
ALR-00277
Timestamp
2026-10-07T05:41:52Z
Severity
Medium
Status
Investigating
Detection Source
Firewall
Assigned Analyst
Marcus Webb

Endpoint Information

Hostname
SW-CORE-01
User Account
c.williams
Source IP
185.238.220.238
Destination IP
10.2.136.30
Origin Country
BR Brazil

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

05:41:52 Event ingested by SOC365 Engine
05:41:54 EmilyAI triage started — correlation enrichment
05:41:58 EmilyAI confidence: 86% — escalated to human analyst
05:42:14 Alert assigned to analyst: Marcus Webb
05:43:27 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00441 3h ago Phishing Email Blocked Low Resolved SW-CORE-01
ALR-00475 5h ago Tor Exit Node Connection Medium Escalated WS-PC-002
ALR-00163 8h ago Tor Exit Node Connection Low False Positive WS-PC-006
ALR-00208 9h ago Tor Exit Node Connection High Investigating SRV-MAIL-01
ALR-00367 15h ago Tor Exit Node Connection Low Escalated WS-LAP-011