Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 19:52:50 UTC

Tor Exit Node Connection

Low Escalated
ALR-00402 · 2026-07-10T21:42:10Z

Description

Connection from SRV-FILE-01 to known Tor exit node detected by Cloud Connector. User 'e.evans' was active at the time.

Alert Metadata

Alert ID
ALR-00402
Timestamp
2026-07-10T21:42:10Z
Severity
Low
Status
Escalated
Detection Source
Cloud Connector
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-FILE-01
User Account
e.evans
Source IP
185.244.220.44
Destination IP
10.1.54.191
Origin Country
IN India

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

21:42:10 Event ingested by SOC365 Engine
21:42:14 EmilyAI triage started — correlation enrichment
21:42:23 EmilyAI confidence: 85% — escalated to human analyst
21:42:42 Alert assigned to analyst: EmilyAI (auto)
21:44:07 Investigation started — querying SIEM and threat intelligence
21:49:32 Containment action taken — endpoint isolated
21:57:26 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00096 4h ago Tor Exit Node Connection Informational Escalated WS-PC-001
ALR-00460 4h ago Tor Exit Node Connection Informational Open WS-LAP-012
ALR-00384 4h ago Port Scan Detected Informational Resolved SRV-FILE-01
ALR-00043 8h ago Pass-the-Hash Detected Low Resolved SRV-FILE-01
ALR-00077 9h ago Phishing Email Blocked High Escalated SRV-FILE-01