Kusto Tor Exit Nodes Table

Description

This data represents Tor exit nodes.

Source

Taken from the publically available resource on the Tor Projects own site https://check.torproject.org/torbulkexitlist

Why should I use this data?

It’s a small dataset and high fidelity given it comes from the Tor Project themselves. It is useful to find Tor nodes within existing datasets and represents a snapshot of the Tor environment on a given time.

Updates

Daily at around 0300UTC although source data is updated more regularly.

Schema

Column Name	Data Type	Notes
IPAddress	string	The given IP address
Source	string	Where this was obtained
Description	string	Description of what this is, eg Exit node on Tor

Base Kusto Table

externaldata (IpAddress:string, Source:string, Description:string) ['https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip'] with (ignoreFirstRecord=true)

Base Kusto Function

let TorExitNodes = externaldata (IpAddress:string, Source:string, Description:string) ['https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip'] with (ignoreFirstRecord=true)

Self Contained Kusto


// Test randomly generated IP addresses will likely return no results
//*** Variables start
let NumberOfIPsToTest = 100;
//*** Variables end
let TorExitNodes = (externaldata (IpAddress:string, Source:string, Description:string)
['https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip']
with (ignoreFirstRecord=true));
let IPsTesting = materialize(
range Position from 1 to (NumberOfIPsToTest) step 1 //Generate x random IP Addresses for testing
| extend IpAddress = strcat(toint(rand(255)), '.', toint(rand(255)), '.', toint(rand(255)), '.', toint(rand(255))));
IPsTesting
| join kind=leftouter (TorExitNodes) on $left.IpAddress == $right.IpAddress
| order by Position asc


// What Tor Exit nodes are in a given country?
// *** Variables start
let CountriesOfInterest = dynamic(['FR', 'ZA']); //France and South Africa
// *** Variabled end
let TorExitNodes = (externaldata (IpAddress:string, Source:string, Description:string)
['https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip']
with (ignoreFirstRecord=true));
let CIDRRanges = (externaldata (CIDRCountry:string, CIDR:string, CIDRSource:string) //Table containing CIDR to ISO Country codes
['https://firewalliplists.gypthecat.com/lists/kusto/kusto-cidr-countries-simple.csv.zip']
with (ignoreFirstRecord=true));
TorExitNodes
| evaluate ipv4_lookup(CIDRRanges, IpAddress, CIDR, return_unmatched=true)
| where CIDRCountry in (CountriesOfInterest)
| order by parse_ipv4(IpAddress) asc


// What countries have the most Tor exit nodes?
let TorExitNodes = (externaldata (IpAddress:string, Source:string, Description:string)
['https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip']
with (ignoreFirstRecord=true));
let CIDRRanges = (externaldata (CIDRCountry:string, CIDR:string, CIDRCountryName:string, CIDRContinent:string, CIDRContinentName:string, CIDRSource:string)
['https://firewalliplists.gypthecat.com/lists/kusto/kusto-cidr-countries.csv.zip']
with (ignoreFirstRecord=true));
TorExitNodes
| evaluate ipv4_lookup(CIDRRanges, IpAddress, CIDR, return_unmatched=true)
| summarize NumberOfExitNodes = array_length(make_set(IpAddress)), ExitNodes = make_set(IpAddress) by CIDRCountryName
| order by NumberOfExitNodes desc

MDE Example


let TorExitNodes = externaldata (IpAddress:string, Source:string, Description:string) ['https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip'] with (ignoreFirstRecord=true);
DeviceLogonEvents
| where RemoteIPType != 'Private'
| where ActionType == 'LogonSuccess'
| evaluate ipv4_lookup(TorExitNodes, RemoteIP, IpAddress, return_unmatched=false)

Sentinel & Azure Log Analytics Example

Coming soon.