How to Search For TOR Traffic in System Logs
Nov 29, 2023
Okta Identity Engine
Administration
Overview
This article describes how to search for TOR traffic in the system logs.
Applies To
- Okta Classic Engine
- Okta Identity Engine (OIE)
Solution
Tor detection is based on the IP and third-party reporting we receive regarding a TOR exit node’s IP address. The admin would also need to check the IP to see if it is a recognized TOR exit node. The system logs will typically attempt to identify the type of Proxy used during a login attempt. The search parameter below can be used to search for the use of a TOR proxy within the system logs.
-
debugContext.debugData.proxyType eq "tor"
