Whisper Security - Tor Exit Node Communication

Original query, unchanged.

// MITRE ATT&CK: T1090.003 - Proxy: Multi-hop Proxy
// Tactic: Command and Control
// Detects communication with Tor exit nodes using Whisper threat intelligence
let timeRange = 1d;
let torIndicators = WhisperThreatIntel_CL
    | where TimeGenerated > ago(timeRange)
    | where isTor == true
    | project indicator, threatScore, threatLevel, feedNames, lastSeen;
let CommonSecurityLogSafe = union isfuzzy=true CommonSecurityLog, (datatable(TimeGenerated:datetime, DestinationIP:string, SourceIP:string, DeviceProduct:string, DeviceAction:string, DeviceVendor:string, Activity:string)[]);
CommonSecurityLogSafe
    | where TimeGenerated > ago(timeRange)
    | where isnotempty(DestinationIP)
    | join kind=inner (torIndicators) on $left.DestinationIP == $right.indicator
    | extend SourceIP = SourceIP, DestinationIP = DestinationIP
    | project TimeGenerated, SourceIP, DestinationIP, DeviceProduct, DeviceAction, DeviceVendor, Activity, threatScore, threatLevel, feedNames