Triage a network alert where an internal host talks to anonymizing or known-bad infrastructure over a covert channel — Tor and onion access, anonymizer exit nodes, known-C2 IPs and ports, DNS over odd ports, unknown protocols, and long-lived beacons. Reads flow records and firewall logs for the remote end, the protocol shape, and the beacon cadence to tell a sanctioned privacy tool apart from confirmed command-and-control, and decides escalate or dismiss.
