Tor Exit Node Connection
Low
Investigating
ALR-00339 · 2026-07-07T18:51:25Z
Description
Connection from WS-PC-006 to known Tor exit node detected by Network IDS. User 'a.wilson' was active at the time.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
18:51:25
Event ingested by SOC365 Engine
18:51:27
EmilyAI triage started — correlation enrichment
18:51:40
EmilyAI confidence: 94% — escalated to human analyst
18:52:09
Alert assigned to analyst: EmilyAI (auto)
18:52:48
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00218 | 2h ago | Tor Exit Node Connection | Informational | Resolved | SRV-FILE-01 |
| ALR-00137 | 7h ago | Tor Exit Node Connection | Medium | Escalated | FW-EDGE-01 |
| ALR-00480 | 9h ago | Tor Exit Node Connection | Medium | False Positive | WS-PC-006 |
| ALR-00135 | 10h ago | Tor Exit Node Connection | High | Open | WS-PC-001 |
| ALR-00476 | 13h ago | C2 Beacon Activity | Low | False Positive | WS-PC-006 |