메뉴
Tor exit node lookups for SOC investigations via Analysi. Use when triaging alerts involving suspicious IPs, anonymous access, credential stuffing, or brute-force attacks to determine if source IPs are Tor exit nodes.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | tor-integration |
| description | Tor exit node lookups for SOC investigations via Analysi. Use when triaging alerts involving suspicious IPs, anonymous access, credential stuffing, or brute-force attacks to determine if source IPs are Tor exit nodes. |
| version | 0.1.0 |
Check whether IP addresses are Tor exit nodes using the Tor Project's public exit node list. No authentication required — the integration queries check.torproject.org/exit-addresses directly.
| Reference | Read when | Consult for |
|---|---|---|
references/actions-reference.md | Calling any Tor action | Parameters, return schemas, Cy examples, edge cases, known limitations |
references/investigation-patterns.md | Building triage workflows | Decision trees, multi-source corroboration with Splunk/AbuseIPDB/WHOIS, Cy task templates |
app::tor::lookup_ip(ip=the_ip), read result.results[0].is_exit_noderesult.resultsapp::tor::health_check() before batch jobs to confirm the exit-node list is reachableactions-reference.md § Known Limitations for details on data freshness, IPv6 gaps, and input validation caveats.is_exit_node: true/false. Pair with WHOIS RDAP or GeoIP for network ownership, ASN, or geolocation context.