* [Blog](https://www.paloaltonetworks.com/blog) * [Security Operations](https://www.paloaltonetworks.com/blog/security-operations/) * [Playbook of the Week](https://www.paloaltonetworks.com/blog/security-operations/category/playbook-of-the-week/) * Handling Successful SSO S... # Handling Successful SSO Sign-ins from Tor [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Fhandling-successful-sso-sign-ins-from-tor%2F) [](https://twitter.com/share?text=Handling+Successful+SSO+Sign-ins+from+Tor&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Fhandling-successful-sso-sign-ins-from-tor%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Fhandling-successful-sso-sign-ins-from-tor%2F&title=Handling+Successful+SSO+Sign-ins+from+Tor&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/security-operations/handling-successful-sso-sign-ins-from-tor/&ts=markdown) \[\](mailto:?subject=Handling Successful SSO Sign-ins from Tor) Link copied By [Omri Itzhak](https://www.paloaltonetworks.com/blog/author/omri-itzhak/?ts=markdown "Posts by Omri Itzhak") Jan 09, 2025 4 minutes [Playbook of the Week](https://www.paloaltonetworks.com/blog/security-operations/category/playbook-of-the-week/?ts=markdown) [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown) [Cortex](https://www.paloaltonetworks.com/blog/tag/cortex/?ts=markdown) [Cortex XSIAM](https://www.paloaltonetworks.com/blog/tag/cortex-xsiam/?ts=markdown) [Single sign-on](https://www.paloaltonetworks.com/blog/tag/single-sign-on/?ts=markdown) [SSO](https://www.paloaltonetworks.com/blog/tag/sso/?ts=markdown) [Tor](https://www.paloaltonetworks.com/blog/tag/tor/?ts=markdown) This playbook is part of the [Cortex Response and Remediation Pack](https://cortex.marketplace.pan.dev/marketplace/details/CortexResponseAndRemediation/), which delivers a powerful collection of automated playbooks designed to streamline incident response and remediation processes, built to support an autonomous SOC vision. The playbooks in this pack are tightly coupled to analytics alerts, leveraging detector logic to provide highly accurate and context-aware responses. This ensures seamless integration with [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)^®^, enabling SOC teams to focus on high-priority threats while automating repetitive tasks. ## **What is Tor?** Tor is a decentralized network designed to enhance privacy and anonymity online. It routes internet traffic through a series of relays, encrypting data at each step to obscure its origin and destination. While Tor can be used for legitimate purposes such as protecting privacy, bypassing censorship, and enabling secure communication, it is also exploited by threat actors to mask malicious activities. This dual-use nature of Tor makes it a critical focus area for security monitoring and automated response mechanisms. In enterprise environments, Tor has almost no legitimate use cases. Its anonymity features conflict with enterprise security policies that prioritize traceability, accountability, and compliance. Therefore, any activity involving Tor in an enterprise context is often treated as suspicious and warrants thorough investigation. Single sign-on (SSO) is a cornerstone of modern enterprise security, offering streamlined access to applications and reducing password management complexities. However, it also presents a significant risk vector if not monitored carefully. Two analytics alerts related to SSO that often indicate potential threats are: * **A successful SSO sign-in from Tor.** * **A successful SSO sign-in from Tor via a mobile device.** These alerts, specifically tied to Cortex XSIAM, flag potential unauthorized or suspicious access attempts. This blog introduces a robust Cortex XSIAM^®^ playbook designed to handle these alerts effectively, ensuring security gaps are mitigated promptly. ## **Purpose of the Playbook** The primary purpose of this playbook is to mitigate security risks by: 1. **Containing potential threats as early as possible.** 2. **Investigating the context of the alert thoroughly.** 3. **Executing remediation actions if malicious activity is detected.** ## **Stages of the Playbook** ### 1. Early Containment Upon receiving an alert of a successful SSO sign-in from a Tor exit node, the playbook initiates **early containment actions** to disrupt any potential malicious activity. Key steps include: * **Clearing or revoking user sessions:** This action terminates the connection originating from the Tor exit node, keeping the attacker outside of the network. * **Enforcing re-authentication:** Ensures that the user's identity is verified before they regain access. The playbook executes these actions using integrations with either Microsoft Graph User (Azure Active Directory Users) or Okta v2, ensuring compatibility across common enterprise authentication platforms. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2025/01/word-image-332960-1.png) ### 2. Investigation In the investigation phase, the playbook dives deeper into the context of the alert, performing the following checks: * **User's risk score:** Evaluate the user's activity to identify abnormal patterns. User risk score is evaluated based on Cortex AI capabilities with a dedicated ML model that evaluates the risk score. * **Suspicious user agent usage:** Identifies anomalies in the browser or device details used for the sign-in. * **Cross-referencing related Cortex XSIAM alerts:** Uses the MITRE ATT\&CK framework to search for: * T1566: Phishing * T1621: Multi-Factor Authentication Request Generation * T1110: Brute Force * T1556: Modify Authentication Process When these techniques are observed alongside a successful SSO login from a Tor exit node within a short time frame, it strongly indicates that an attacker is leveraging stolen credentials, bypassing MFA, and securing unauthorized access---hallmarks of advanced malicious campaigns. These steps provide a holistic view of the user's activity, helping to differentiate between legitimate and malicious access attempts. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2025/01/word-image-332960-2.png) ### 3. Remediation If the investigation uncovers: * A high-risk score. * Suspicious user agent activity. * Related malicious Cortex XSIAM alerts. The playbook suggests the analyst disable the user's account to prevent further access. This action requires analyst approval, ensuring human oversight before taking significant steps like disabling an account. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2025/01/word-image-332960-3.png) ## **Integration Requirements** To execute the response actions, the playbook requires one of the following integrations: * **Microsoft Graph User (Azure Active Directory Users)** * **Okta v2** These integrations ensure seamless execution of containment, investigation, and remediation actions, aligning with enterprise authentication standards. ## **Addressing Security Challenges** The alerts tied to successful SSO sign-ins from Tor indicate potential security gaps that can lead to: 1. **Unauthorized access:** Malicious actors may exploit anonymity to access sensitive data. 2. **Account compromise:** Tor's obfuscation can hide credential stuffing or brute-force attacks. 3. **Data exfiltration:** Once access is gained, sensitive information can be extracted. This playbook provides an automated, structured response to mitigate these risks, ensuring: * Threats are contained before causing damage. * Investigations provide actionable insights. * Remediation actions prevent recurring access attempts. ### Learn More For detailed documentation and implementation guidance, visit the[Cortex XSIAM Playbooks Documentation](https://xsoar.pan.dev/docs/reference/playbooks/a-successful-sso-sign-in-from-tor). Stay ahead of evolving threats and protect your enterprise with Cortex XSIAM's automated playbooks. *** ** * ** *** ## Related Blogs ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown) [#### The Clock Is Running: What Frontier AI Means for Your SOC](https://www.paloaltonetworks.com/blog/security-operations/the-clock-is-running-what-frontier-ai-means-for-your-soc/) ### [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown) [#### From ILOVEYOU to AI Defenders -- 25 Years of Email Evolution](https://www.paloaltonetworks.com/blog/security-operations/from-iloveyou-to-ai-defenders-25-years-of-email-evolution/) ### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown) [#### Transform Your SOC with Cortex XSIAM: Lessons From a Zombie Infestation](https://www.paloaltonetworks.com/blog/security-operations/transform-your-soc-with-cortex-xsiam-lessons-from-a-zombie-infestation/) ### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Cortex Advanced Email Security -- Built for Today's AI Threats](https://www.paloaltonetworks.com/blog/security-operations/cortex-advanced-email-security-built-for-todays-ai-threats/) ### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Partner Integrations](https://www.paloaltonetworks.com/blog/security-operations/category/partner-integrations/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Flexible Security Data Management with Cortex XSIAM \& Cribl](https://www.paloaltonetworks.com/blog/security-operations/cortex-xsiam-integration-with-cribl-brings-flexible-data-management-to-security-operations/) ### [Playbook of the Week](https://www.paloaltonetworks.com/blog/security-operations/category/playbook-of-the-week/?ts=markdown) [#### Automating Response to Suspicious SaaS Access From a Tor Exit Node](https://www.paloaltonetworks.com/blog/security-operations/automating-response-to-suspicious-saas-access-from-a-tor-exit-node/) ### Subscribe to Security Operations Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language