Toutrial: Detecting Tor Traffic in XSIAM

A.Elzedy — Wed, 25 Jun 2025 19:20:07 GMT

Hi Everyone,

Some members in the community have recently been exploring ways to detect Tor traffic within their environments. I’ve spent some time working on a solution to this challenge, and I wanted to turn that work into a dedicated post so more people can benefit from it.

Why This Matters ?

Detecting communication with Tor exit nodes gives your team visibility into potentially suspicious behavior, regardless of the application or protocol used.

Step 1: Use a Reliable Exit Node Source

Instead of relying on rate-limited or unstable feeds, I recommend using this curated and regularly updated list:

https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip

Download and extract the ZIP file.

The CSV file already includes a header named IPAddress, which is required for XSIAM ingestion.

Step 2: Upload the Dataset to Cortex XSIAM

Go to
Settings > Configurations > Data Management > Dataset Management
Click + Lookup
Upload the CSV file
Name the dataset something clear, like tor_nodes

This creates a reusable dataset that can be referenced in your detection logic.

Step 3: Run the Detection Query

Use the following XQL query to identify any network events involving known Tor exit nodes:

dataset = xdr_data | filter event_type = ENUM.NETWORK | join type = inner ( dataset = tor_nodes | fields IPAddress ) as tor_list action_remote_ip = tor_list.IPAddress | fields agent_hostname, action_remote_ip, event_timestamp, IPAddress

This method has already helped a few teams gain better visibility into anonymized traffic, and I hope it proves just as useful for others here. If you have feedback, enhancements, or alternative approaches, I’d genuinely appreciate hearing them.

The strength of this community lies in our willingness to share, challenge, and refine ideas together.

Re: Toutrial: Detecting Tor Traffic in XSIAM

eluis — Thu, 26 Jun 2025 16:56:18 GMT

Hi A.Elzedy,

Very good tutorial and topic

KR,

Luis

Re: Toutrial: Detecting Tor Traffic in XSIAM

A.Elzedy — Fri, 27 Jun 2025 10:33:38 GMT

Thank you @eluis !

topic Re: Toutrial: Detecting Tor Traffic in XSIAM in Cortex XDR Discussions

Toutrial: Detecting Tor Traffic in XSIAM

Why This Matters ?

Step 1: Use a Reliable Exit Node Source

Step 2: Upload the Dataset to Cortex XSIAM

Step 3: Run the Detection Query

Re: Toutrial: Detecting Tor Traffic in XSIAM

Re: Toutrial: Detecting Tor Traffic in XSIAM