Tor Exit Node Connection
High
Open
ALR-00475 · 2026-05-24T11:20:48Z
Description
Connection from SRV-SQL-01 to known Tor exit node detected by Firewall. User 's.jones' was active at the time.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
11:20:48
Event ingested by SOC365 Engine
11:20:49
EmilyAI triage started — correlation enrichment
11:21:02
EmilyAI confidence: 82% — escalated to human analyst
11:21:10
Alert assigned to analyst: Emma Richardson
11:22:59
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00485 | 44m ago | Brute Force SSH | Low | False Positive | SRV-SQL-01 |
| ALR-00453 | 7h ago | Tor Exit Node Connection | Low | Investigating | SRV-MAIL-01 |
| ALR-00222 | 11h ago | Tor Exit Node Connection | Low | Investigating | FW-EDGE-01 |
| ALR-00225 | 11h ago | Suspicious Scheduled Task | Low | False Positive | SRV-SQL-01 |
| ALR-00473 | 18h ago | Tor Exit Node Connection | Medium | False Positive | WS-PC-002 |