Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 06:51:49 UTC

Tor Exit Node Connection

Low Escalated
ALR-00321 · 2026-10-11T11:23:15Z

Description

Connection from WS-LAP-010 to known Tor exit node detected by EmilyAI Triage. User 'p.thomas' was active at the time.

Alert Metadata

Alert ID
ALR-00321
Timestamp
2026-10-11T11:23:15Z
Severity
Low
Status
Escalated
Detection Source
EmilyAI Triage
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-010
User Account
p.thomas
Source IP
194.200.62.141
Destination IP
10.2.119.21
Origin Country
US United States

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

11:23:15 Event ingested by SOC365 Engine
11:23:18 EmilyAI triage started — correlation enrichment
11:23:26 EmilyAI confidence: 79% — escalated to human analyst
11:23:42 Alert assigned to analyst: EmilyAI (auto)
11:24:33 Investigation started — querying SIEM and threat intelligence
11:32:11 Containment action taken — endpoint isolated
11:37:59 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00192 7h ago Ransomware Behaviour Detected Low Escalated WS-LAP-010
ALR-00040 8h ago Lateral Movement Detected Informational Escalated WS-LAP-010
ALR-00463 19h ago Unauthorised USB Device Low Open WS-LAP-010
ALR-00025 1d ago Pass-the-Hash Detected Medium Open WS-LAP-010
ALR-00432 1d ago Port Scan Detected Low Open WS-LAP-010