Toutrial: Detecting Tor Traffic in XSIAM

[A.Elzedy]

Hi Everyone, 

Some members in the community have recently been exploring ways to detect Tor traffic within their environments. I’ve spent some time working on a solution to this challenge, and I wanted to turn that work into a dedicated post so more people can benefit from it.

Why This Matters ?

Detecting communication with Tor exit nodes gives your team visibility into potentially suspicious behavior, regardless of the application or protocol used.

Step 1: Use a Reliable Exit Node Source

Instead of relying on rate-limited or unstable feeds, I recommend using this curated and regularly updated list:

https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip 

• Download and extract the ZIP file.

The CSV file already includes a header named IPAddress, which is required for XSIAM ingestion.

Step 2: Upload the Dataset to Cortex XSIAM

1. Go to
   Settings > Configurations > Data Management > Dataset Management
2. Click + Lookup
3. Upload the CSV file
4. Name the dataset something clear, like tor_nodes

This creates a reusable dataset that can be referenced in your detection logic.

Step 3: Run the Detection Query

Use the following XQL query to identify any network events involving known Tor exit nodes:

dataset = xdr_data
| filter event_type = ENUM.NETWORK
| join type = inner (
    dataset = tor_nodes
    | fields IPAddress
  ) as tor_list action_remote_ip = tor_list.IPAddress 
| fields agent_hostname, action_remote_ip, event_timestamp, IPAddress

This method has already helped a few teams gain better visibility into anonymized traffic, and I hope it proves just as useful for others here. If you have feedback, enhancements, or alternative approaches, I’d genuinely appreciate hearing them.

The strength of this community lies in our willingness to share, challenge, and refine ideas together.

[eluis]

Hi A.Elzedy, 

Very good tutorial and topic

KR, 

Luis 

[A.Elzedy]

Thank you @eluis !