How to Search For TOR Traffic in System Logs
Last Updated:
Okta Identity Engine
Administration
Overview
This article describes how to search for TOR traffic in the system logs.
Applies To
- Okta Classic Engine
- Okta Identity Engine (OIE)
Solution
Tor detection is based on the IP and third-party reporting we receive regarding a TOR exit node’s IP address. The admin would also need to check the IP to see if it is a recognized TOR exit node. The system logs will typically attempt to identify the type of Proxy used during a login attempt. The search parameter below can be used to search for the use of a TOR proxy within the system logs.
-
debugContext.debugData.proxyType eq "tor"
