Tor Exit Node Connection
Informational
Resolved
ALR-00394 · 2026-07-07T08:54:50Z
Description
Connection from AP-WIFI-03 to known Tor exit node detected by DecoyPulse. User 'r.davies' was active at the time.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
08:54:50
Event ingested by SOC365 Engine
08:54:51
EmilyAI triage started — correlation enrichment
08:55:05
EmilyAI confidence: 89% — escalated to human analyst
08:55:33
Alert assigned to analyst: EmilyAI (auto)
08:57:41
Investigation started — querying SIEM and threat intelligence
08:59:27
Containment action taken — endpoint isolated
09:14:39
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00198 | 3h ago | Insider Threat Indicator | Medium | Open | AP-WIFI-03 |
| ALR-00348 | 4h ago | Tor Exit Node Connection | Medium | False Positive | AP-WIFI-03 |
| ALR-00048 | 6h ago | Shadow IT Discovery | Medium | Escalated | AP-WIFI-03 |
| ALR-00271 | 7h ago | Tor Exit Node Connection | Medium | False Positive | WS-PC-002 |
| ALR-00391 | 10h ago | Tor Exit Node Connection | Informational | False Positive | SRV-FILE-01 |