Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:49:13 UTC

Tor Exit Node Connection

Informational Investigating
ALR-00420 · 2026-10-05T05:59:45Z

Description

Connection from SRV-BACKUP-01 to known Tor exit node detected by Email Gateway. User 'n.clark' was active at the time.

Alert Metadata

Alert ID
ALR-00420
Timestamp
2026-10-05T05:59:45Z
Severity
Informational
Status
Investigating
Detection Source
Email Gateway
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-BACKUP-01
User Account
n.clark
Source IP
185.2.220.106
Destination IP
10.3.47.164
Origin Country
DE Germany

MITRE ATT&CK Mapping

Tactic
Command and Control
Technique
T1090.003
Reference
attack.mitre.org/techniques/T1090.003

Investigation Timeline

05:59:45 Event ingested by SOC365 Engine
05:59:46 EmilyAI triage started — correlation enrichment
06:00:00 EmilyAI confidence: 92% — escalated to human analyst
06:00:01 Alert assigned to analyst: EmilyAI (auto)
06:01:56 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00184 10h ago Tor Exit Node Connection Informational Resolved AP-WIFI-03
ALR-00065 16h ago Tor Exit Node Connection High Investigating AP-WIFI-03
ALR-00182 17h ago Tor Exit Node Connection Low Escalated SRV-DC-01
ALR-00346 19h ago Pass-the-Hash Detected Low Resolved SRV-BACKUP-01
ALR-00180 1d ago DecoyPulse Honeypot Triggered Low Investigating SRV-BACKUP-01